Ubuntu Server running VNC

You can remotely set the registry key

[HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4] "Password"=hex:xx xx xx xx

to figure out what hex value to set you can set it on a test machine and copy the resultant value, or you could use a tool which there a many of to generate one for you

EDIT

it even looks like there is an app for this I havent tested this I have only just searched for it on google, but there are a load of results with similar promises

Putty does support ssh tunnels, if you expand the Connection, SSH tree, you'll see an entry for tunnels.

Local tunnels produce a localhost port opening on your windows machine that remotes to the ip address and port you specify. For instance, when I'm trying to RDP to a desktop at my house, I'll generally choose a random local port, something like 7789, then put the local ip address of the desktop (1.2.3.4:3389) as the remote host. Be sure to click "Add", then "Apply." At this point, when you rdp to 127.0.0.1:7789, you'll then connect to 1.2.3.4:3389 over the putty session.

This is where the fun comes in. If you then setup a port tunnel on your intermediate box, setting up the local port you specified as the remote port in putty, you can then bounce through your putty, through the intermediate box your final destination. You'll still need to do a few ssh connects, but you'll be able to cross vnc or rdp directly from the windows system once you're set, which is what I believe you're looking to do.

EXAMPLE

1. Head over to the tunnels panel in Putty (Connections->SSH->Tunnels accessed either from the context menu if the ssh session is already active, or in the beginning connection screen when just starting putty)
2. Create a tunnel with local source 15900, and remote source 127.0.0.1:15900
3. Connect (if not already connected) to Gateway1.
4. On Gateway1, ssh -L 127.0.0.1:15900:VNCServerIP:5900 user@Gateway2
5. Once the ssh to Gateway2 is up, attempt to vnc to 127.0.0.1:15900 -- you should now see the VNC screen on the far side!

ADDED BONUS -- not many people know this, but this process can also be used to proxy IPv6/IPv4 traffic as well. SSH doesn't care what protocol it uses for the tunnels, so you can theoretically access IPv6 only hosts from an IPv4 only system, given that the ssh server is dual stack (has both IPv4 and IPv6 addresses.)