ICARUS
An exploit for Chrome devices which allows people to unenroll devices with device management interception using a proxy and a custom Certificate Authority.
Important
DO NOT USE ANY PUBLIC IP ADDRESSES FOR ICARUS AS A PROXY, YOU WILL RISK YOUR DATA and YOU WILL BE REMOTELY COMPROMISED.
ANYTHING GOOGLE CAN REMOTELY PERFORM ON YOUR DEVICE, ICARUS CAN BE USED TO DO. AN EXAMPLE OF THIS IS INSTALL EXTENSIONS, SPY, USE YOUR CAMERA, REMOTE INTO YOUR DEVICE, GET YOUR PASSWORDS, AND MORE.
ONLY SELF HOST ICARUS, NEVER USE A PUBLIC SERVER!
New configs?
"New configs" have rolled keys. We are testing the compatibility of these new keys for interception.
Setup and installation instructions
Clone the repo with git clone --recursive https://github.com/MunyDev/icarus/ and change directory to it.
Set up the environment by running the following commands (Make sure you have python3, python3-venv, and protobuf installed beforehand):
make setup-venvmake enter-venvmake setup-pythonmake build-packed-data
Before continuing, open Chrome on your build machine and go to chrome://components. Press CTRL + F and search for "PKIMetadata". Once you find it, press "Check for Updates". Make sure it says up-to-date before continuing (and that the version is below 2000.)
bash get_original_data.shbash make_out.sh myCA.der
After doing this the output directory (from here on reffered to as PKIMetadata) will be generated, which is the custom Certificate Authority.
Now, to modify the shim with the generated PKIMetadata:
bash modify.sh <shim path>
Now boot the shim, and ICARUS will attempt to modify your stateful partition.
Server setup
Requirements: npm, node
Run make start-server to start your proxy, then continue with the instructions below.
Do not use WSL to host a server!
Setup and installation instructions, continued
Reboot the device. You'll boot into verified mode. Once you have your server running, open the network configuration by clicking the lower right button (it will show the date), connecting to wifi, and then change the proxy settings accordingly.
- Set proxy settings to manual
- Set HTTPS IP to the IP you used to host the proxy server.
- Resume setup and your device will unenroll.
Troubleshooting
During building, everything starting from root was copied into original!
Please run git pull on your local copy. This bug has been fixed.
My device says "Can't reach Google"!
- Make sure your device and the server are connected to the same network
- If that didn't work, powerwash your device and re-run the modified shim, and keep the server running.