Chromebook Breakout: Escaping Jail Using a Pico Ducky
Jimi Allee demonstrates escaping enterprise-enrolled Chromebook kiosk mode using a Raspberry Pi Pico Ducky and living-off-the-land command injection.
Summary
The Architecture of Enterprise ChromeOS Enrollment
ChromeOS devices in educational and enterprise environments enforce strict management policies, disabling developer mode and restricting device usage to locked kiosk apps.
Building a Low-Cost Pico Ducky Hardware Tool
Jimi Allee shows how to program an affordable Raspberry Pi Pico running CircuitPython into a programmable BadUSB keystroke injection tool.
Chaining Diagnostic Shortcuts with Command Injection
Allee walks through an exploit chain exploiting debugging shortcuts, accessibility menus, and local command injection to spawn an unconstrained root shell.
Restoring Device Freedom and Enterprise Mitigations
The author explains how to un-enroll locked devices and provides ChromeOS administrators with policy configurations to patch kiosk breakout paths.
Related talks
Eye on Tech·3 min
Presenters detail vulnerability discovery and exploitation in Samsung Galaxy Chromebook Hands-on Preview.
Hacktivity - IT Security Festival·42 min
Zsombor Kovács
Presenters detail vulnerability discovery and exploitation in Hacktivity 2012 - Zsombor Kovács - To secure data is to prepare for jailbreak.
Main Stage·40 min
Gal Zror
Gal Zror discloses six new vulnerabilities in Ruckus Wireless ZoneDirector and Unleashed access points, achieving unauthenticated root RCE over the air.