Listen local port 9999 to forward traffic to target rdp using SSH tunnel of exploited host
ssh -L 9999:10.10.20.140:3389 msx@192.168.68.117
Use Proxychain to route traffic through exploited host
ssh -D 127.0.0.1:1090 msx@192.168.68.117
Usage example nmap scan
proxychains nmap -sT -v 10.10.20.140
RootSecurity 