SSH "reverse" ProxyCommand
Using ssh tunneling it is fairly easy; first go to your Server machine and run:
ssh -R 2222:localhost:22 intermediateuser@Intermediate
this opens port 2222 on intermediate machine, reverse forwarding connections to port 22 on the server.
Then you can
ssh user@Intermediate
and from there
ssh serveruser@localhost -p 2222
Or alternatively, you might bring port 2222 on Intermediate to your workstation with:
ssh -L 2222:localhost:2222 intermediateuser@Intermediate
then:
ssh serveruser@localhost -p 2222