I finally managed to accomplish this with ssh only:

1. start a local SOCKS proxy on your client machine (using ssh -D) EDIT: not necessary with SSH>7.6
2. connect to remote server and setup a reverse port forwarding (ssh -R) to your local SOCKS proxy
3. configure the server software to use the forwarded proxy

1. Start local socks proxy in the background

EDIT SSH>7.6 allow a simpler syntax to start the proxy. Skip this and continue with step 2!

Connect to localhost via SSH and open SOCKS proxy on port 54321.

$ ssh -f -N -D 54321 localhost

-f runs SSH in the background.

Note: If you close the terminal where you started the command, the proxy process will be killed. Also remember to clean up after yourself by either closing the terminal window when you are done or by killing the process yourself!

2. connect to remote server and setup reverse port forwarding

Bind remote port 6666 to local port 54321. This makes your local socks proxy available to the remote site on port 6666.

$ ssh root@target -R6666:localhost:54321

EDIT SSH>7.6 allows a simpler syntax to start the proxy! Step 1 is not needed then:

$ ssh root@target -R6666:localhost

3. configure the server software to use the forwarded proxy

Just configure yum, apt, curl, wget or any other tool that supports SOCKS to use the proxy 127.0.0.1:6666.

Voilá! Happy tunneling!

4. optional: install proxychains to make things easy

proxychains installed on the target server enables any software to use the forwarded SOCKS proxy (even telnet). It uses a LD_PRELOAD trick to redirect TCP and DNS requests from arbitrary commands into a proxy and is really handy.

Setup /etc/proxychains.conf to use the forwarded socks proxy:

[ProxyList]
# SSH reverse proxy
socks5  127.0.0.1 6666

Tunnel arbitrary tools (that use TCP) with proxychains:

$ proxychains telnet google.com 80
$ proxychains yum update
$ proxychains apt-get update

This is what I do when I have a very similar problem (but mine is Linux via Linux and I use port 5901 for VNC):

First, we make it so that all connections to localhost:13389 on your laptop will go to the intermediate server (on port 3389):

laptop$ ssh -L 13389:localhost:3389 my_user@LINUX_SERVER_IP

Then, we make it so it that all connection to localhost:3389 on the intermediate server are forwarded to the PC behind the firewall (on port 3389):

my_user@LINUX_SERVER_IP$ ssh -L 3389:localhost:3389 'PRIVATE_DOMAIN\my_user'@PC_NAME

(note that this command is run inside the interactive shell on the intermediate server.)

Now, you should be able to connect to localhost:13389 and access port 3389 on the remote PC.

Debugging

Since it isn't working, there's a few things we can try. We'll do in a way to isolate where the issue is:

1. On the remote PC you want to access, can you telnet localhost 3389 to ensure it's open and ready for connections? Microsoft has a nice article on it
2. If that works, can you try to execute telnet localhost 3389 on the intermediate server to check it's forwarding correctly to the remote PC?
3. Finally, telnet localhost 13389 on your laptop, to see if it's forwarding all the way through.

As soon as you hit an error stop there and please add a comment so we figure it out.