Apple Device Enrollment Program (DEP) - ByPass MDM Policy using Checkra1n exploit

README.MD

Steps

1. Install iproxy

• On MacOS, run: brew install usbmuxd

2. Boot ramdisk

• Follow instructions here to boot the ramdisk for modifying iOS image.
  • After this, you should be able to ssh into the device.

3. Modify CloudConfigurationDetails.plist

• In the ssh terminal, run:
  • cd /mnt2/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles
  • nano CloudConfigurationDetails.plist
    • Copy, paste, and save the following:

      <?xml version="1.0" encoding="UTF-8"?>
      <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
      <plist version="1.0">
      <dict>
          <key>ConfigurationWasApplied</key>
          <true/>
          <key>CloudConfigurationUIComplete</key>
          <true/>
          <key>PostSetupProfileWasInstalled</key>
          <true/>
          <key>AllowPairing</key>
          <true/>
          <key>AutoAdvanceSetup</key>
          <false/>
          <key>AwaitDeviceConfigured</key>
          <false/>
          <key>ConfigurationSource</key>
          <integer>0</integer>
          <key>ConfigurationURL</key>
          <string></string>
          <key>IsMDMUnremovable</key>
          <integer>0</integer>
          <key>IsMandatory</key>
          <false/>
          <key>IsMultiUser</key>
          <false/>
          <key>IsSupervised</key>
          <false/>
          <key>OrganizationAddress</key>
          <string>N/A</string>
          <key>OrganizationAddressLine1</key>
          <string>N/A</string>
          <key>OrganizationAddressLine2</key>
          <string>N/A</string>
          <key>OrganizationCity</key>
          <string>N/A</string>
          <key>OrganizationCountry</key>
          <string>N/A</string>
          <key>OrganizationDepartment</key>
          <string>N/A</string>
          <key>OrganizationEmail</key>
          <string>noreply@localhost.localdomain</string>
          <key>OrganizationMagic</key>
          <string></string>
          <key>OrganizationName</key>
          <string>Skip this step</string>
          <key>OrganizationPhone</key>
          <string>N/A</string>
          <key>OrganizationSupportPhone</key>
          <string>N/A</string>
          <key>OrganizationZipCode</key>
          <string>N/A</string>
          <key>SkipSetup</key>
          <array/>
          <key>SupervisorHostCertificates</key>
          <array/>
      </dict>
      </plist>
      

  • reboot