glibc Missing From Older Linux Distributions

 

After installing the latest version of Cobalt Strike some customers have reported issues when running the Team Server related to older Linux distributions not having glibc or the correct version of glibc (2.29).

This is a summary of the steps used to patch the Cobalt Strike TeamServerImage to use locally built instance of glibc-2.29

Requirements

These vary based on distribution.

• patchelf must be installed.
• The glibc configure script below will identify any additional missing dependencies for making glibc.

Steps

1. Download glibc source:

   wget "https://ftp.gnu.org/gnu/glibc/glibc-2.29.tar.gz"

2. Extract glibc source:

   tar -xzf "glibc-2.29.tar.gz"

3. Create build folders:

   mkdir logs

   mkdir build

4. cd build

5. Run the glibc make configuration command:

   THIS IDENTIFIES MISSING REQUIRED DEPENDENCIES FOR MAKE (you will need to resolve missing dependencies). Output is redirected to a file here:

   "{path}/glibc-2.29/configure" --disable-werror "--prefix=/opt/glibc-2.29-for-cs" > ../logs/configure.log

6. Run glibc make command:

   This will probably run for several minutes. Output is redirected to a file here:

   make > ../logs/make.log

7. Run glibc make install command:

   THIS MUST RUN AS ROOT. IT CREATES/INSTALLS IN /opt/... Output is redirected to a file here:

   make install > ../logs/make-install.log

8. Edit the teamserver script.

   When finished and working, make similar changes to the c2lint and peclone scripts. As written, these scripts will re-extract TeamServerImage each time they run, so patching must occur each time.

   1. Add patchelf command towards the bottom script.

      Add this before "./TeamServerImage ..." command at the bottom of the script:

      patchelf --set-interpreter "/opt/glibc-2.29-for-cs/lib/ld-linux-x86-64.so.2" --set-rpath "/opt/glibc-2.29-for-cs/lib" ./TeamServerImage

   2. Prefix the current "./TeamServerImage ..." command with a "LD_LIBRARY_PATH" definition.

      • For Ubuntu (16/18) and Debian (9/10):

        LD_LIBRARY_PATH="/opt/glibc-2.29-for-cs/lib:/usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu"

        Updated line example:

        LD_LIBRARY_PATH="/opt/glibc-2.29-for-cs/lib:/usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu" ./TeamServerImage -Dcobaltstrike.server_port=50050 ...

      • For CentOS (7/8):

        LD_LIBRARY_PATH="/opt/glibc-2.29-for-cs/lib:/usr/lib64/"

        Updated line example:

        LD_LIBRARY_PATH="/opt/glibc-2.29-for-cs/lib:/usr/lib64/" ./TeamServerImage -Dcobaltstrike.server_port=50050 ...