Apple Device Enrollment Program (DEP) - ByPass MDM Policy using Checkra1n exploit

README.MD

Pre-requirements

• Install a socket daemon to multiplex connections from and to iOS devices, run: brew install usbmuxd
• Start the socket daemon iproxy 2222 44
• Install checkra1n exploit locally, run: brew install checkra1n
• When SSH password authentication is requested, use: alpline.

Wipe iPad and restore Firmware

• Clear all settings, or use DFU to clear and restore the iPad: https://www.theiphonewiki.com/wiki/DFU_Mode (Use iTunes to restore (and wipe) the iPad)
• When the iPad returns at the 'Hello' screen, exploit using checkra1n, run: open /Applications/checkra1n.app
• Follow its instructions, until returning at the 'Hello' screen.

Initial Setup - Checkra1n booted

• Create a new profile at /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist, by copying the file through SCP. Notice the essentials in the profile: ConfigurationWasApplied, CloudConfigurationUIComplete & PostSetupProfileWasInstalled

TEMPFILE=$(mktemp)
DESTFILE=/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist

cat > ${TEMPFILE} << _EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>ConfigurationWasApplied</key>
    <true/>
    <key>CloudConfigurationUIComplete</key>
    <true/>
    <key>PostSetupProfileWasInstalled</key>
    <true/>
    <key>AllowPairing</key>
    <true/>
    <key>AutoAdvanceSetup</key>
    <false/>
    <key>AwaitDeviceConfigured</key>
    <false/>
    <key>ConfigurationSource</key>
    <integer>0</integer>
    <key>ConfigurationURL</key>
    <string></string>
    <key>IsMDMUnremovable</key>
    <integer>0</integer>
    <key>IsMandatory</key>
    <false/>
    <key>IsMultiUser</key>
    <false/>
    <key>IsSupervised</key>
    <false/>
    <key>OrganizationAddress</key>
    <string>N/A</string>
    <key>OrganizationAddressLine1</key>
    <string>N/A</string>
    <key>OrganizationAddressLine2</key>
    <string>N/A</string>
    <key>OrganizationCity</key>
    <string>N/A</string>
    <key>OrganizationCountry</key>
    <string>N/A</string>
    <key>OrganizationDepartment</key>
    <string>N/A</string>
    <key>OrganizationEmail</key>
    <string>[email protected]</string>
    <key>OrganizationMagic</key>
    <string></string>
    <key>OrganizationName</key>
    <string>Skip this step</string>
    <key>OrganizationPhone</key>
    <string>N/A</string>
    <key>OrganizationSupportPhone</key>
    <string>N/A</string>
    <key>OrganizationZipCode</key>
    <string>N/A</string>
    <key>SkipSetup</key>
    <array/>
    <key>SupervisorHostCertificates</key>
    <array/>
</dict>
</plist>
_EOF

scp -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${TEMPFILE} root@localhost:${DESTFILE} && rm ${TEMPFILE}

• Now complete the iPad setup throught its user interface, it should not ask for a remote management profile, until it is wiped clean.

Hey this helped me a lot in the past. Today I wrote updated version without need for jailbreaking. https://github.com/erikhric/ios15-mdm-bypass

Erik, Good to hear that my notes are useful! I will read your writeup as soon as I have the time for it. Regards, Frank

…

On Tue, 22 Nov 2022 at 12:25, Erik Hric ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ Hey this helped me a lot in the past. Today I wrote updated version without need for jailbreaking. https://github.com/erikhric/ios15-mdm-bypass — Reply to this email directly, view it on GitHub <https://gist.github.com/a5f6c0b8ae640bfa9909a396e1ceb03c#gistcomment-4377807> or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAWRNMKYZURWWG62U4S7G6TWJSUSFBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTANZSGE2DSNBQU52HE2LHM5SXFJTDOJSWC5DF> . You are receiving this email because you authored a thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

@FrankSpierings @erikhric is there any update for A12 devices like iphone XR ?

Great workaround, I've successfully bypassed iP7 & iP6s running iOS 15.7.2.