After spending 2 hours trying to set up the environment, I can attest that the least painless method is to just set up a Xenial Xerus Docker container with socat to connect out. I was able to just switch the hostnames when my exploit was done, much easier than fiddling with LD_PRELOAD etc.