ICARUS

ChromeOS Unenrollment via Proxy and Custom Certificate Authority
--:--
df59b00 - mobile layout

What is ICARUS?

ICARUS is an exploit for Chrome devices which allows people to unenroll devices with device management interception using a proxy and a custom Certificate Authority.

WARNING: Never use public proxies for ICARUS. Always self-host to avoid security risks. Do not use a third-party server since they CAN remotely access your chromebook, remotely enroll you into their domain, giving them your IP and other info, and everything that Google can do like wipe your chromebook and other things.

What is ICARUS-Lite?

The original dev team had stopped maintaining ICARUS, cosmic, along with the help of others has stepped up to help.

What is ICARUS-Revived?

ICARUS-Revived is essentially a maintained version of the original repo with new certs and other stuff, but the server code is still broken. Use ICARUS-Lite for the server.

Repos:

What you need/Requirements

Building an ICARUS modified shim

Clone either fanq's repo or kxtz's repo (for this guide i will be using fanq's repo) and set up the environment (Make sure you have python3, python3-venv, and protobuf installed beforehand) :

  1. Clone the github repostiory: git clone --recursive https://github.com/fanqyxl/icarus
  2. Change the directory to ICARUS: cd icarus
  3. Setup the Python Virtual Environment: make setup-venv
  4. Enter the Virtual Environment: make enter-venv
  5. Setup Python: make setup-python
  6. Build the packed data: make build-packed-data

Ensure Chrome's PKIMetadata component is up to date but below version 2000:

  1. Open Chrome on your build machine and go to chrome://components.
  2. Press CTRL + F and search for "PKIMetadata".
  3. Click "Check for Updates" and ensure it is up to date but below version 2000.

Generate the PKIMetadata:

  1. bash get_original_data.sh
  2. bash make_out.sh myCA.der

Modify the shim with the generated PKIMetadata:

  1. bash modify.sh <shim path>

Flashing a prebuilt shim

  1. Go to one of these file hosts: and download a prebuilt shim for your corresponding board.
  2. Flash the shim to a USB not and SD card since they often have issues, if you don't know how to flash it's in the Troubleshooting section.

Booting the shim

Now boot the shim, and ICARUS will attempt to modify your stateful partition. It should say Finished Click Enter to Reboot, which you will click enter, and everything SHOULD go smoothly

Steps on how to boot a shim:

  1. Get to the recovery screen by pressing Esc+Refresh+Power
  2. Once you get to the recovery screen, press Ctrl+D
  3. It's going to try to make you go back to Secure Mode (It's going to turn off and open up a gray screen), ignore this and press Esc+Refresh+Power once more
  4. You should be in developer mode and on the recovery screen, now plug in your USB and it should boot the shim!

Various errors you may encounter

  • If it gives you a Failed to modify stateful error, simply plug the USB in a different port, if your using a sd card, use a USB
  • If you get a cros_debug error, simply retry and it should work

Server Setup

Use Icarus-Lite for this, which has been tested on all operating systems.

Windows Instructions

  1. Go to Icarus-Lite's latest releases
  2. Download the exe
  3. Run the exe
  4. follow instructions ICARUS-Lite gives you and it'll tell you IP and port to use. If it doesn't work check the ICARUS-Lite repo's README.md

Linux/Mac OS Intructions

make sure you the following installed ==> python, git

  1. clone github repo with git clone https://github.com/cosmicdevv/Icarus-Lite.git
  2. change directory to it by cd Icarus-Lite
  3. install all python package dependencies by pip install -r requirements.txt (if this doesn't work look at the Linux/Mac Instructions here)
  4. Run the main python file by python main.py
  5. ICARUS-Lite will attempt to automatically set up the required file structure and download the latest SSL certificates from kxtz's Icarus fork.
  6. follow instructions ICARUS-Lite gives you and it'll tell you IP and port to use. If it doesn't work check the ICARUS-Lite repo's README.md

Public servers

you should never use public servers, use this as a last ditch if you can't get the server running or if you don't have a device to host on

Once the chromebook reboots after booting the shim, and your at the Welcome! screen, don't proceed, do the following:

  1. Click Shift+Alt+S , It should open up a menu
  2. Connect to WiFi from there.
  3. Edit proxy settings by clicking on wifi once more (A popup should show up).
  4. Set proxy settings to manual.
  5. Set Secure HTTP IP to the IP of your proxy server (local ip if it's hosted on localhost). The port will 99.9% be 8126 unless you changed it
  6. Resume setup and your chromebook will unenroll.

Troubleshooting

Q: My device says "Can't reach Google"!

A:

Q: How to Flash a USB/SD card?

A:

Q: How to check your kernver

A:

Credits

MunyDev - Lead developer of ICARUS

Xmb9 - Script improvements

r58Playz - General enhancements

Akane - SSL support and guidance

cosmicdevv - Writing and maintaining ICARUS-Lite

kxtzownsu - Maintaining certificates Icarus uses

fanqyxl - Emotional support + keyrolling his chromebook lol

AC3 - Helping in times of depression and desperate needs

T3RM1N4L - Making the website