ManualEscape

Permanent server side unenrollment with enrollment permissions

THIS EXPLOIT STRICTLY REQUIRES THE PERMISSION TO ENROLL EXISTING OR NEW DEVICES, IF YOUR STUDENT CREDENTIALS LACK THIS PERMISSION THEN YOU WILL BE UNABLE TO PERFORM THIS EXPLOIT

(works on all devices, and every version!)

instructions: 

1. go to https://accounts.google.com/v3/signin/identifier?flow=deviceEnrollment&flowName=GlifSetupChromeOs

2. sign in with your student credentials

3. when it freezes, go to devtools, navigate to applications > cookies > accounts.google.com and find the `oauth_code` cookie then copy the value of the cookie

4. run the unenroll.py script and input the oauth code copied from the previous step and the serial number of the device you want to unenroll

5. powerwash the chromebook, it will be permanently unenrolled and you can now enable developer mode

(if devtools is blocked, please do not ask us for help, use a different device that does not block devtools)

script instructions:

1. download the unenroll.py script and the device_management_backend_pb2.py lib respectively

2. install the required dependencies by running `python3 -m pip install protobuf requests google`

3. run the script by running `python3 unenroll.py`

(the python command may vary by distribution/operating system please look this up yourself!)

note: make sure device_management_backend_pb2.py is in the same directory you are running the script in or it will error

Credits: 

-katie: https://discord.gg/uE7ADaCzD7