d4rtht3ll3ctus' root vault

Windows Netsh Port Forward

1 min read

Netsh is a Windows command-line tool that can help with the network configuration of a particular Windows system. Here are just some of the networking related tasks we can use Netsh for:

  • Finding routes
  • Viewing the firewall configuration
  • Adding proxies
  • Creating port forwarding rules

This would allow us to pivot further from within the network the workstation is in.

Diagram showing an RDP request from Attack Host (10.10.15.5) to Windows Server (172.16.5.25) via Windows10 User (10.129.15.150) using Netsh.exe. The request listens on port 8080 and forwards to port 3389.

We can use netsh.exe to forward all data received on a specific port (say 8080) to a remote host on a remote port. This can be performed using the below command.

Using Netsh.exe to Port Forward

netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.15.150 connectport=3389 connectaddress=172.16.5.25
netsh.exe interface portproxy show v4tov4
 
Listen on ipv4:             Connect to ipv4:
 
Address         Port        Address         Port
--------------- ----------  --------------- ----------
10.129.15.150   8080        172.16.5.25     3389

After configuring the portproxy on our Windows-based pivot host, we will try to connect to the 8080 port of this host from our attack host using xfreerdp. Once a request is sent from our attack host, the Windows host will route our traffic according to the proxy settings configured by netsh.exe.

Graph View