Send a TCP tool through a SOCKS proxy from a foothold, with the scanning limits that come with it
Command:
# point proxychains at the SOCKS port your tunnel opened, one entry, last line wins
echo 'socks5 127.0.0.1 1080' | sudo tee -a /etc/proxychains4.conf
tail -n 3 /etc/proxychains4.conf
References: