Cobalt Strike
Installation Guide
Copyright Terms and Conditions
Copyright © Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective
owners.
The content in this document is protected by the Copyright Laws of the United States of America and other countries worldwide. The
unauthorized use and/or duplication of this material without express and written permission from Fortra is strictly prohibited. Excerpts
and links may be used, provided that full and clear credit is given to Fortra with appropriate and specific direction to the original
content.
202407160903 - 4.10
Before You Begin / System Requirements
Before You Begin
Read this section before you install Cobalt Strike.
System Requirements
The following items are required for any system hosting the Cobalt Strike client and/or server
components.
Java
Cobalt Strike's GUI client and team server require one of the following Java environments:
l
Oracle Java 11
l
OpenJDK 11. (see Installing OpenJDK on page 5 for instructions)
NOTE:
If your organization does not have a license that allows commercial use of Oracle's Java,
we encourage you to use OpenJDK 11.
Supported Operating Systems
Cobalt Strike Team Server is supported on a Linux system that meets the Java requirements
and has been tested on the following Debian based Linux distributions (other versions may
work but have not been tested):
l
Debian
l
Ubuntu
l
Kali Linux
Cobalt Strike Client runs on the following systems:
l
Windows 7 and above
l
MacOS X 10.13 and above
l
GUI based Linux, such as: Debian, Ubuntu and Kali Linux (other versions may work but
have not been tested)
Hardware
Cobalt Strike Installation Guide www.fortra.com page: 4
Before You Begin / Installing OpenJDK
In addition to an accepted operating system, the below minimum requirements should be
met:
l
2 GHz+ processor
l
2 GB RAM
l
500MB+ available disk space
On Amazon's EC2, use at least a High-CPU Medium (c1.medium, 1.7 GB) instance.
Linux glibc
Be aware that certain Linux distributions may be missing or don't have the correct version of
glibc. If you run into that issue, review the Knowledge Article, glibc Missing From Older Linux
Distributions, on the Fortra Portal.
Installing OpenJDK
Cobalt Strike is tested with OpenJDK 11 and its launchers are compatible with a properly
installed OpenJDK 11 environment.
Linux (Kali 2018.4, Ubuntu 18.04)
1. Update APT:
sudo apt-get update
2. Install OpenJDK 11 with APT:
sudo apt-get install openjdk-11-jdk
3. Make OpenJDK 11 the default:
sudo update-java-alternatives -s java-1.11.0-openjdk-amd64
Linux (Other)
1. Uninstall the current OpenJDK package(s).
2. Download OpenJDK for Linux/x64 at: https://jdk.java.net/archive/.
3. Extract the OpenJDK binary:
tar zxvf openjdk-11.0.1_linux-x64_bin.tar.gz
4. Move the OpenJDK folder to /usr/local:
mv jdk-11.0.1 /usr/local
Cobalt Strike Installation Guide www.fortra.com page: 5
Before You Begin / Installing OpenJDK
5. Add the following to ~/.bashrc:
JAVA_HOME="/usr/local/jdk-11.0.1"
PATH=$PATH:$JAVA_HOME/bin
6. Refresh your ~/.bashrc to make the new environment variables take effect:
source ~/.bashrc
MacOS X
1. Download OpenJDK for macOS/x64 at: https://jdk.java.net/archive/.
2. Open a Terminal and navigate to the Downloads/ folder.
3. Extract the archive:
tar zxvf openjdk-11.0.1_osx-x64_bin.tar.gz
4. Move the extracted archive to /Library/Java/JavaVirtualMachines/:
sudo mv jdk-11.0.1.jdk/ /Library/Java/JavaVirtualMachines/
The java command on MacOS X will use the highest Java version in /Library/Java as the
default.
TIP:
If you are seeing a JRELoadError message this is because the JavaAppLauncher stub
included with Cobalt Strike loads a library from a set path to run the JVM within the stub
process. Issue the following command to fix this error:
sudo ln -fs /Library/Java/JavaVirtualMachines/jdk-11.0.2.jdk
/Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin
Replace jdk-11.0.2.jdk with your Java path. The next Cobalt Strike release will use a Java
Application Stub for MacOS X that is more flexible.
Windows
1. Download OpenJDK for Windows/x64 at: https://jdk.java.net/archive/.
2. Extract the archive to c:\program files\jdk-11.0.1.
3. Add c:\program files\jdk-11.0.\bin to your user's PATH environment variable:
a. Go to Control Panel-> System-> Change Settings-> Advanced-> Environment
Variables....
b. Highlight Path in User variables for user.
c. Press Edit.
d. Press New.
Cobalt Strike Installation Guide www.fortra.com page: 6
Before You Begin / Wayland Desktop - Not Supported
e. Type: c:\program files\jdk-11.0.1\bin.
f. Press OK on all dialogs.
Wayland Desktop - Not Supported
Wayland is a modern replacement for the X Windows System. Wayland has made great
strides, as a project, and some desktop environments use it as their default window system.
Don't let the adoption fool you though. Not all applications or application environments work
100% perfectly on Wayland. There are still bugs and issues to address.
There are bugs in Java (or Wayland) that may cause a graphical Java application to crash,
during normal use, when run in a Wayland desktop. These bugs affect Cobalt Strike users.
Fortra does not support the use of Cobalt Strike on Wayland desktops.
Am I using Wayland?
Type echo $XDG_SESSION_TYPE to find out if you're on wayland or x11.
How to disable Wayland on Kali Linux
The latest version of Kali Linux 2017 Rolling uses a Wayland desktop by default. To change
this back to X11:
1. Open /etc/gdm3/daemon.conf with your favorite text editor.
2. Find the [daemon] section.
3. Add WaylandEnable=false and reboot your system.
Cobalt Strike Installation Guide www.fortra.com page: 7
Installing Cobalt Strike / Wayland Desktop - Not Supported
Installing Cobalt Strike
Follow these instructions to install Cobalt Strike.
NOTE:
The Cobalt Strike Distribution Package (steps 1 and 3) contains the OS-specific Cobalt
Strike launcher(s), supporting files, and the updater program. It does not contain the
Cobalt Strike program itself. Running the Update Program (step 4) downloads the Cobalt
Strike product and performs the final installation steps.
1. Download a Cobalt Strike distribution package for a supported operating system. (an
email is provided with a link to the download)
2. Setup a recommended Java environment. (see Installing OpenJDK on page 5 for
instructions)
3. Extract, mount or unzip the distribution package. Based on the operating system
perform one of the following.
a. For Linux:
i. Extract the cobaltstrike-dist-linux.tgz:
tar zxvf cobaltstrike-dist-linux.tgz
b. For MacOS X:
i. Use your preferred zip tool to extract the cobaltstrike-dist-mac.zip file to
an install location.
c. For Windows:
i. Disable anti-virus before you install Cobalt Strike.
ii. Use your preferred zip tool to extract the cobaltstike-dist-windows.zip file
to an install location.
4. Run the update program to finish the install. Based on the operating system perform
one of the following.
a. For Linux:
i. Enter the following commands:
cd /path/to/cobaltstrike
./update
b. For MacOS X:
i. Navigate to the Cobalt Strike folder.
ii. Double-click Update Cobalt Strike.command.
Cobalt Strike Installation Guide www.fortra.com page: 8
After You are Done / Next Steps
c. For Windows:
i. Navigate to the Cobalt Strike folder.
ii. Double-click update.bat.
Make sure you update both your team server and client software with your license key. Cobalt
Strike is generally licensed on a per user basis. The team server does not require a separate
license.
After You are Done
Congratulations! Cobalt Strike is now installed. Read the following for additional information
and your next steps.
Next Steps
Refer to the user guide for information about starting the Cobalt Strike Team Server and
Cobalt Strike Client.
Cobalt Strike Installation Guide www.fortra.com page: 9
