SocksOverRDP
SOCKS tunnel through an existing RDP virtual channel.
It stands up a SOCKS proxy by riding the dynamic virtual channels of an already-open RDP connection. When the only access to an internal Windows machine is over Remote Desktop, this method tunnels arbitrary traffic inside that same RDP session, without opening a new port or raising outbound-connection suspicion. It is a client-side plugin plus a remote-side server; once loaded, proxychains pointed at the local SOCKS reaches the whole network that Windows can see.
Family Pivoting & tunnelling
Flags SocksOverRDP-Plugin.dll SocksOverRDP-Server.exe
Concepts Dynamic Port Forwarding (SOCKS)
Cheatsheet Windows redirectors & exotic tunnels
Installation
# SOCKS tunnel over an existing RDP session (two pieces, both from the repo release):
# 1) on the first pivot, load the plugin into the RDP session:
regsvr32.exe SocksOverRDP-Plugin.dll
# 2) on the second host (as admin), open the server channel:
SocksOverRDP-Server.exe
# 3) a local SOCKS ends up on 127.0.0.1:1080 on the pivot (check with netstat)Useful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.