> For the complete documentation index, see [llms.txt](https://g4b0.gitbook.io/g4b0-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://g4b0.gitbook.io/g4b0-docs/documentation/cheatsheets/tunneling-and-portforwarding/port-forwarding-with-windows-netsh.md).

# Port Forwarding with Windows Netsh

`netsh.exe` es una herramienta nativa de Windows para configuración de red. Permite realizar tunneling sin instalar software adicional, lo que la convierte en una técnica de Living-off-the-Land ideal para pivoting.

**Tareas de red que soporta:**

* Ver tabla de rutas
* Inspeccionar configuración del firewall
* Añadir proxies
* Crear reglas de port forwarding

**Escenario:** Acceso al workstation Windows 10 de un admin IT (`10.129.15.150` / `172.16.5.25`) obtenido mediante phishing/social engineering. Desde allí se pivota hacia un servidor interno (`172.16.5.25`) con RDP.

> Flujo: Attack Host (`10.10.15.5`) → Windows10 Pivot (`10.129.15.150:8080`) → Windows Server (`172.16.5.25:3389`)

***

#### 1. Crear regla de port forwarding

```cmd
netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.15.150 connectport=3389 connectaddress=172.16.5.25
```

* `v4tov4` — IPv4 entrante a IPv4 saliente
* `listenport=8080` — puerto en el que escucha el pivot
* `listenaddress=10.129.15.150` — IP de la interfaz expuesta (la que alcanzamos)
* `connectport=3389` — puerto de destino en la red interna (RDP)
* `connectaddress=172.16.5.25` — host interno al que redirigir

***

#### 2. Verificar regla activa

```cmd
netsh.exe interface portproxy show v4tov4
```

**Output esperado:**

```
Listen on ipv4:             Connect to ipv4:

Address         Port        Address         Port
--------------- ----------  --------------- ----------
10.129.15.150   8080        172.16.5.25     3389
```

***

#### 3. Conectarse desde el Attack Host

```bash
xfreerdp /v:10.129.15.150:8080 /u:victor /p:'pass@123'
```

* `/v` — IP:puerto del pivot (el tráfico será redirigido a `172.16.5.25:3389`)
* `/u` y `/p` — credenciales del host interno

**Output esperado:** sesión RDP activa sobre `172.16.5.25`, visible en la IP de la interfaz interna (`172.16.5.19`).

> **Nota:** Al lanzar el target, esperar 3-5 minutos para que el laboratorio termine de configurarse antes de intentar la conexión.

***

#### OpSec

**`netsh portproxy` escribe la regla en el registro de Windows (`HKLM\SYSTEM\CurrentControlSet\Services\PortProxy`), dejando artefactos persistentes que sobreviven reinicios y son detectables por soluciones EDR y auditorías de registro.**

* Limpiar al terminar:

```cmd
netsh.exe interface portproxy delete v4tov4 listenport=8080 listenaddress=10.129.15.150
```

***

#### Remediación

* Monitorizar cambios en la clave de registro `PortProxy` y el uso de `netsh.exe` por procesos no administrativos como señal de pivoting activo.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://g4b0.gitbook.io/g4b0-docs/documentation/cheatsheets/tunneling-and-portforwarding/port-forwarding-with-windows-netsh.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.