PortBender

PortBender is a Windows TCP port redirection utility implemented as a reflective C++ DLL using WinDivert and Windows Filtering Platform (WFP). Redirector mode redirects inbound connections targeting one TCP port to a local alternate port, including use cases such as making an SMB relay listener reachable through port 445. Backdoor mode simulates the Duqu 2.0 PortServ-style gated redirection: a specially formatted TCP packet carrying the configured keyword adds its source IP to a client list, after which that client's traffic to the selected port is redirected while PortBender remains active. This emulates a backdoor behavior; it does not install PortServ.sys or establish reboot-surviving persistence.