netsh Port Proxying

netsh interface portproxy is Windows’ built-in TCP relay: the host listens on a local address/port and forwards each connection onward to a target you choose. On a compromised pivot it turns the Windows box into a jump point — no binaries to upload, no firewall rule changes needed (the relay lives in the iphlpsvc service, not the firewall):

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=3389 connectaddress=10.0.0.5

Now anyone who can reach the pivot on 8080 gets RDP to 10.0.0.5. Modes cover v4tov4, v4tov6, v6tov4, v6tov6; works on Windows 7 / Server 2008 R2 and later (the v6 variants need IPv6 enabled). Management is symmetric:

netsh interface portproxy show all
netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0

Operational notes:

• Persistence — portproxy rules survive reboots (stored in the registry under HKLM\SYSTEM\CurrentControlSet\Services\PortProxy), so they’re a quiet access-maintaining mechanism as well as a relay. Clean them up.
• Inbound reachability still depends on the firewall — relaying is silent, but if the listen port is blocked you still need an allow rule; see netsh-windows-firewall for opening one without popping UI.
• Detection — netsh interface portproxy show all and the registry key above are trivial host-hunt queries; iphlpsvc making outbound connections it shouldn’t is a strong network signal.

Related

• netsh-windows-firewall — the same tool’s firewall control plane
• ssh — SSH remote forwarding, the cross-platform alternative
• netstat — verifying what’s actually listening after you add a relay

Sources

• netsh interface
• Cheatsheet_UsefulCommands.txt