.. /Netsh PortProxy
Star

Access

The Windows built-in netsh utility can configure a port proxy (interface portproxy) that forwards TCP connections from a listening address and port to another host and port. No additional binary is required and the rule survives reboots.

Paths:

Resources:

Detections:

Access

  1. Forwards inbound connections on the compromised host to an internal system, turning it into a pivot or relay.

    netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=<PORT> connectaddress=<TARGET_IP> connectport=<TARGET_PORT>
    Use case
    Pivoting to internal hosts using only built-in tooling.
    Privileges required
    Administrator
    Operating systems
    Windows

  2. Lists configured port proxy rules. Useful for both attackers and defenders.

    netsh interface portproxy show all
    Use case
    Enumerating existing forwards.
    Privileges required
    User
    Operating systems
    Windows