[Tornado711]

Recently, I've been working in the social engineering toolkit (SET) and I'm generating a malicious PDF file, and using a windows shell code reverse_tcp to establish a connection. My goal is to establish a connection between my desktop running kali linux and my laptop running on windows 7. However, after choosing which attack I want to use, it asks me for the LHOST for the listener. Earlier it also asks for the ip of the attacker so it can establish a connection. I'm not sure in either of these cases which IP to use. Do I use my public IP or my private IP? Also, while using nmap I've noticed something referred to as RHOST used. What is that?


Thanks,
Matt

[Cibor]

LHOST = your IP (local host)
RHOST = target's IP (remote host)

[Tornado711]

LHOST = your IP (local host)
RHOST = target's IP (remote host)

Alright LHOST would be my IP, but would it be my private IP or my public IP? Also which IP would I use for the reverse connection payload? As it asks for that from me aswell

[grady]

Alright LHOST would be my IP, but would it be my private IP or my public IP? Also which IP would I use for the reverse connection payload? As it asks for that from me aswell

Depends on the scope of the exploit.
What IP would yours be relative to the machine you're attempting to exploit?

[Cibor]

Alright LHOST would be my IP, but would it be my private IP or my public IP? Also which IP would I use for the reverse connection payload? As it asks for that from me aswell

If your target is outside of your LAN, then you have to use public IP.
Keep in mind that you might need to do some port-forwarding in the router, from public to private.

[Tornado711]

If your target is outside of your LAN, then you have to use public IP.
Keep in mind that you might need to do some port-forwarding in the router, from public to private.

Alright, so for the payload and reverse connection it would depend on the scope. As for the LHOST how could I get my localhost IP? Also what if I was to establish a connection through say port 80, that's usually allowed on most routers since it's almost essential, so I imagine I wouldn't have to forward that?

[Nomad.Null]

Alright, so for the payload and reverse connection it would depend on the scope. As for the LHOST how could I get my localhost IP? Also what if I was to establish a connection through say port 80, that's usually allowed on most routers since it's almost essential, so I imagine I wouldn't have to forward that?

Here's my suggestion, kiddo. You should build your own security lab to practice in, if you aren't doing that already. This way, you know you're working within a LAN scope. Keep things simple. KISS method and all that jazz.

There are a handful of available virtual machines for you to test exploits out on, like Metasploitable, or any number of machines on VulnHub.com where there are virtual machines AND tutorials. I recommend the Damn Vulnerable Web App (DVWA for short).

Now, back to your problem. You're trying to run metasploit payloads against your targets but you really don't have a very good grasp of the Metasploit syntax yet. In fact, you barely seem to know the linux syntax, so I think you need to take a few steps back and learn the fundamentals. Here is what I would suggest you do to start with.

Go to https://www.cybrary.it/ and sign up for a free account. It's a great site to get started learning InfoSec. This isn't a requirement, but I would appreciate if you mention my name/profile as a referrer. 🤝

Next get started with some training courses

Learn Linux Command Line:
https://www.cybrary.it/course/comptia-linux-plus/
http://ryanstutorials.net/linuxtutorial/
http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html
(Don't be put off by appearances. These are excellent sources, especially the last one!)

Next, make sure you have a basic understanding of networking. If you barely know anything about computers at all, start with CompTIA A+. Otherwise, move on to CompTIA Network+
https://www.cybrary.it/course/comptia-aplus/
https://www.cybrary.it/course/comptia-network-plus/

While it is not required, I would also suggest the Security+ course to get a fundamental understanding of security best practices. It's important to know your basics.
https://www.cybrary.it/course/comptia-security-plus/

After all these, you are ready to start working with security tools...
https://www.cybrary.it/course/ethical-hacking/
Start getting familiar with metasploit...
https://www.cybrary.it/course/metasploit/
https://www.offensive-security.com/metas...unleashed/
How to get away with the loot and cover your tracks...
https://www.cybrary.it/course/post-explo...n-hacking/


and eventually move on to some more advanced techniques like exploitation...
https://www.cybrary.it/course/advanced-p...n-testing/
Coding your own tools...
https://www.cybrary.it/course/python/
And even creating, analyzing, and reverse engineering malware if you like!
https://www.cybrary.it/course/malware-analysis/

Lots of good stuff to learn. There are more suggestions in my free book (click signature) if you are interested. The general idea is that you need to crawl before you walk, and walk before you run. Right now, I'm guessing you're feeling like you started free-climbing Mt. Everest. Start from the beginning, start slow, and don't stop moving forward.

Good luck 🤝