It is not possible to get the IP address of a Tor hidden service.
For a normal Tor circuit, the client knows the IP of the server, but the server does not know the IP of the client.
The idea behind hidden services is that when both a client and a server are Tor-enabled, it's possible to build Tor circuits in both directions and hide both the client and server IP (by using intermediate nodes).
- The hidden service picks N introduction points, builds a Tor circuit to each, and communicates its public key
- The hidden service advertises these introduction points and its public key
- The client chooses an entirely new relay called a "rendezvous point", builds a Tor circuit to it, and tells it a newly-generated one-time secret
- The client contacts an advertised introduction point over a Tor circuit and tells it the rendezvous point's IP and the one-time secret, encrypted by the hidden service's public key
- The introduction point relays this encrypted rendezvous point and one-time secret to the hidden service over the existing Tor circuit
- The hidden service decrypts this data, builds a Tor circuit to the rendezvous point, and tells it the one-time secret
- The rendezvous point now relays information between these two Tor circuits
This is what IPs each actor knows after this process:
- The hidden service knows the IPs of its introduction points
- The client knows the IPs of the hidden service's introduction points
- The client knows the IP of the rendezvous point
- The hidden service knows the IP of the rendezvous point
Essentially, at no point is a Tor circuit built directly to the hidden service, the hidden service always builds its circuits outwards. Therefore, its IP is never revealed.
References: a high-level description of the protocol can be found in Tor: Hidden Service Protocol, while a more detailed description can be found in the original design paper Tor: The Second-Generation Onion Router.