RHOSTS LHOST
RHOSTS is the target — $LAB only; LHOST/LPORT is your listener on the lab attacker VM.
Visual · msf_rhosts_lhost
set RHOSTS $LAB ; set LHOST your_attacker_ip. Original Cyberlium.
One wrong RHOSTS line turns literacy into an incident — type $LAB deliberately.
RHOSTS (remote host) must be YOUR lab victim at $LAB — never a public internet address. LHOST is where reverse payloads connect back — your attacker VM on the host-only segment. LPORT must not collide with real services. Double-check every set line against RoE before check or run in later modules. Next: Show Options.
1. RHOSTS discipline
Type $LAB from RoE — not from memory of a tutorial IP. If RoE says $LAB=10.0.0.5, set that, not 'the whole subnet.'
RHOSTS file ranges belong only to lab networks you own — never dorm /24.
Command guide
Try these commands — RHOSTS discipline
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
RHOSTS/LHOST — https://docs.rapid7.com/metasploit/msf-console-commands/ Network options — https://docs.rapid7.com/metasploit/using-metasploit/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
═══ LINUX / macOS ═══
Command — copy this
msfconsole -q -x 'grep RHOST; grep LHOST; exit' 2>/dev/null || msfconsole -q -x 'help set; exit' 2>/dev/null || echo 'RHOSTS must be YOUR lab IP only'
Primary tools to practice this lesson: msfconsole. Reference sites: RHOSTS/LHOST (https://docs.rapid7.com/metasploit/msf-console-commands/); Network options (https://docs.rapid7.com/metasploit/using-metasploit/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. LHOST / LPORT
Reverse payloads call home to LHOST. On host-only labs, use the attacker VM IP on that segment. Firewall rules on host OS still matter — keep traffic inside the lab vSwitch.
3. Defender view
Wrong LHOST (0.0.0.0 on bridged Wi-Fi) leaks callbacks. Defenders watch egress; you contain egress to lab.
4. What you ship: RHOSTS/LHOST definitions with $LAB
Define RHOSTS=$LAB and LHOST=attacker lab IP. NEVER public RHOSTS. chmod 600.
5. What you record before the next lesson
Date. Definitions. $LAB value from RoE. File t14-m05-l01-rhosts-lhost.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: set RHOSTS 8.8.8.8. set LHOST 0.0.0.0 on café network.
- Right: Document $LAB and LHOST rules. Next: Show Options.
Mission: write RHOSTS/LHOST rules
1) Copy $LAB from RoE. 2) Write LHOST rule for attacker VM on host-only net. 3) Add NEVER public RHOSTS line. Do not run modules yet.
Stuck? Ask Cyberlium AI Mentor
Say RHOSTS aloud before run — catches typos.
APPLY: RHOSTS should be:
APPLY: True or False: LHOST is where reverse shells connect back.
APPLY: set RHOSTS to a stranger IP: