How to find LHOST?

Question

This is a problem that I have beaten my head over for quite some time.

I want to embed malicious code into a program , and when a victim opens it it will give me access to a meterpreter session on the device, for this i use an application named Shellter, which is a program used to embed metasploit payloads into applications.

Here is the problem: I can't figure out my LHOST, when I try to exploit the meterpreter payload all I get is a failed to bind error( I think this is because My LHost is wrong)

I have tried to do the following things:

1) use ifconfig in kali linux, however none of the things it shows seem to be my LHOST:

`eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255
        inet6 fe80::b348:618e:2b67:6265  prefixlen 64  scopeid 0x20<link>
        ether 08:00:27:a8:6f:0d  txqueuelen 1000  (Ethernet)
        RX packets 11  bytes 1940 (1.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 25  bytes 2538 (2.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 14  bytes 818 (818.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 14  bytes 818 (818.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0 `

2) I tried cmd ipconfig and used some IP's from there (mainly the ethernet and virtualbox hosts)

3)I typed ip into google (it was the same in kali and windows)

4) I also looked in my setting(in kali linux) and used the ip from there.

5) I looked A LOT on the internet but I could not find anything

ps:maybe I am using the wrong ports? pps: my kali linux says it has a wired connection

Answer 1

Note: This is different for internal victims(On ur own LAN)

For external victims, LHOST of the payload should be your public IP. Reason is that LHOST is embedded within the first stage payload. It must be able to connect back to the handler which means if the victim is outside the LAN, the payload stager needs a routable IP address to reach the handler. I will call the LHOST in payload as LHOST-PAYLOAD. Now suppose you have used port 443 as the LPORT. For the sake of understanding, I will refer to LPORT in payload as LPORT-PAYLOAD. LHOST of the multi/handler should be 0.0.0.0 or the internal IP. I wil call the LHOST in handler as LHOST-HANDLER. Use LPORT 443 in the handler. For the sake of understanding I will refer to this payload as LPORT-HANDLER.

LHOST-PAYLOAD = Public IP LPORT-HANDLER = LPORT-PAYLOAD LHOST-HANDLER = 0.0.0.0 or internal IP of Kali

Then port forward 443 to the internal IP address of the Kali machine. So the configuration should look like: Incoming 443 -> Kali-IP:443

Which means any incoming connection with destination port 443 should be forwarded to the Kali machine where the handler is looking for incoming connection on port 443. Hence you are connected.

Answer 2

The LHOST is simply the ip address that is reachable from your attacker. I'm going to assume that you are using a reverse shell payload or something that needs to connect back to you, otherwise the LHOST is not needed.

If you are on the same network, 10.0.2.15 should work. If target needs the internet to connect to you, you need your public ip address. If you determine that you need the public ip address and you are behind a router, you may need to configure port forwarding, as the public IP is usually assigned to your router only.

If you are configuring LHOST of the listener (multi/handler), LHOST can be set to 0.0.0.0. You still need to configure the router (if you are using one, and going through the internet) to port forward though.

Now, failed to bind can be due to ip address or port. If none of your network interface have the IP you place in LHOST, you get a bind error. Also, if you use restricted ports (1024 and below) and you don't have root privileges, bind error again. It could also be the port you want to bind to is already in use. Netstat and grep is your friend.

netstat -antp | egrep -i list

So make sure to look into this.

Lastly, it could be a firewall that's messing you up and not the LHOST value. Go make sure that your ingress rules allow for connection to whatever port you put into. Although this wouldn't really cause you a bind error.

Answer 3

if you are running this on a virtual machine make sure it is Bridged adapter so it can connect with other devices on the network because that looks to me like it is NAT