diff --git a/Cracking/recovery.html b/Cracking/recovery.html new file mode 100644 index 0000000..090f65a --- /dev/null +++ b/Cracking/recovery.html @@ -0,0 +1,179 @@ + + +
++原作者:你们最伟大的黑客sun12
+修改:小月半
+实际操作前请认真、完整阅读此教程
+
在系统中点击左上角Apple图标并点击弹出菜单中的关于本机
+显示intel芯片,那么恭喜你你可以关掉这个教程了
+如果是像这样显示“Apple M”,那么恭喜你可以继续(忽略那个箭头,那是我在网上找的图)
+首先将macbook完全关机(左上角苹果logo➡️关机)
+黑屏后等待10秒钟并按住电源键不要松,你就会看到苹果标下面显示“继续按住以显示启动选项”
+等待显示“正在载入启动选项之后松开,进入启动菜单后有两种情况”
+一种是成功进入菜单就像下图
+另一种是一个输入密码的界面(一个锁的图标,下面让你输入密码)这种情况无法使用此教程刷机
+如果你的电脑符合以上条件那么恭喜你你可以往下看了
+首先刷机前一定要把东西备份!!!
+刷机会把所有东西都删掉,所以学校装的Self Service就不存在了(后续会出骗老师用的假Self Service)
+当然App Store可以用了还能自由下载软件(就和新的一样)
+学校一些必要的软件后续会补全到客客邦大群的文件里
+备份的所有文件可以压缩成一个压缩包临时传到钉钉里或者拷到u盘里(总之放到这台电脑之外的地方就行)
+一切准备就绪后就可以开始刷机了
+首先根据刚刚讲到的方法进入启动菜单
+进入这个界面后用鼠标双击右边的那个齿轮(底下显示恢复或者Recovery)或者键盘用➡️选中那个齿轮并按Enter
+启动的样子和正常一样,过一会儿就会进入恢复
+正常来说是这样的,如果你的显示要输入密码,不用管,无脑点抹掉Mac
+如果你是进入了上图的那个界面,首先点击顶栏的“实用工具”,弹出的菜单中点击“终端”
+终端大概长这样⬆️
+在里面输入resetpassword然后Enter
弹出窗口后在顶栏选项弹出的菜单里找到“抹掉Mac”
+然后一路确定直到窗口全部消失变成一个苹果进度条后就成功了
+重启后会进入一个英文的界面让你选择语言,如果没有让你选择语言直接进入了恢复界面你可以选择顶栏的“Files”,
+在弹出的列表中选择“Choose Language”选择中文即可,完成选择恢复界面中的“安装 macOS”
+连接网络(在王府你可以连“MLearning”,密码为“M2MLearning”)
+在macOS安装器中一路下一步即可,安装到的硬盘应该叫“Macintosh HD”如果不是请到磁盘工具自行重命名
+安装过程中请确保电量充足,并保持互联网连接,一定不要关上屏幕!!!
+安装完成后会重启(开机动静特别大)然后等待一段时间后就会进入系统配置界面了
+注意一定不要操作!!直接长按电源十秒强制关机!!不然以上的步骤得重来!!
+系统并没有安装完成,还有个傻b王府设置的监管锁,这个锁无法让你完成系统的配置并进入桌面
+接下来将绕过监管锁(为什么不能去掉?一个是不太好去,另一个是去掉锁会被信息中心发现)
+首先在关机状态下进入恢复模式(已经讲过了)
+进入恢复模式后在菜单中打开Safari浏览器(记得联网)
+用Safari浏览器打开这个页面,然后全选并复制以下代码(一定要全选!!!)
+绕监管锁的代码:
+#!/bin/bash
+RED='\033[1;31m'
+GRN='\033[1;32m'
+BLU='\033[1;34m'
+YEL='\033[1;33m'
+PUR='\033[1;35m'
+CYAN='\033[1;36m'
+NC='\033[0m'
+echo -e "${CYAN}*-------------------*---------------------*${NC}"
+echo -e "${GRN}* Auto Bypass MDM Lock for MacOS *${NC}"
+echo -e "${CYAN}* use it carefully! *${NC}"
+echo -e "${RED}* Phoenix Team & NBT Union *${NC}"
+echo -e "${CYAN}*-------------------*---------------------*${NC}"
+echo -e "${CYAN}*Note:不要重命名MacOS默认硬盘!its called Macintosh HD*${NC}"
+echo -e "${CYAN}*LOL hf hf hf hf XD*${NC}"
+echo ""
+PS3='Please enter your choice: '
+options=("Autoypass on Recovery" "Reboot")
+select opt in "${options[@]}"; do
+ case $opt in
+ "Autoypass on Recovery")
+ echo -e "${GRN}Bypass on Recovery"
+ if [ -d "/Volumes/Macintosh HD - Data" ]; then
+ diskutil rename "Macintosh HD - Data" "Data"
+ fi
+ echo -e "${GRN}Create a new user / Tạo User mới"
+ echo -e "${BLU}Press Enter to continue, Note: Leaving it blank will default to the automatic user / Nhấn Enter để tiếp tục, Lưu ý: có thể không điền sẽ tự động nhận User mặc định"
+ echo -e "Enter the username (Default: Apple) / Nhập tên User (Mặc định: Apple)"
+ read realName
+ realName="${realName:= Apple}"
+ echo -e "${BLUE}Nhận username ${RED}WRITE WITHOUT SPACES / VIẾT LIỀN KHÔNG DẤU ${GRN} (Mặc định: Apple)"
+ read username
+ username="${username:=Apple}"
+ echo -e "${BLUE}Enter the password (default: 1234) / Nhập mật khẩu (mặc định: 1234)"
+ read passw
+ passw="${passw:=1234}"
+ dscl_path='/Volumes/Data/private/var/db/dslocal/nodes/Default'
+ echo -e "${GREEN}Creating User / Đang tạo User"
+ # Create user
+ dscl -f "$dscl_path" localhost -create "/Local/Default/Users/$username"
+ dscl -f "$dscl_path" localhost -create "/Local/Default/Users/$username" UserShell "/bin/zsh"
+ dscl -f "$dscl_path" localhost -create "/Local/Default/Users/$username" RealName "$realName"
+ dscl -f "$dscl_path" localhost -create "/Local/Default/Users/$username" RealName "$realName"
+ dscl -f "$dscl_path" localhost -create "/Local/Default/Users/$username" UniqueID "501"
+ dscl -f "$dscl_path" localhost -create "/Local/Default/Users/$username" PrimaryGroupID "20"
+ mkdir "/Volumes/Data/Users/$username"
+ dscl -f "$dscl_path" localhost -create "/Local/Default/Users/$username" NFSHomeDirectory "/Users/$username"
+ dscl -f "$dscl_path" localhost -passwd "/Local/Default/Users/$username" "$passw"
+ dscl -f "$dscl_path" localhost -append "/Local/Default/Groups/admin" GroupMembership $username
+ echo "0.0.0.0 deviceenrollment.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts
+ echo "0.0.0.0 mdmenrollment.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts
+ echo "0.0.0.0 iprofiles.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts
+ echo -e "${GREEN}Successfully blocked host / Thành công chặn host${NC}"
+ touch /Volumes/Data/private/var/db/.AppleSetupDone
+ rm -rf /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigHasActivationRecord
+ rm -rf /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigRecordFound
+ touch /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled
+ touch /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigRecordNotFound
+ echo -e "${CYAN}------ Autobypass SUCCESSFULLY / Autobypass HOÀN TẤT ------${NC}"
+ echo -e "${CYAN}------ Exit Terminal , Reset Macbook and ENJOY ! ------${NC}"
+ break
+ ;;
+ "Disable Notification (SIP)")
+ echo -e "${RED}Please Insert Your Password To Proceed${NC}"
+ sudo rm /var/db/ConfigurationProfiles/Settings/.cloudConfigHasActivationRecord
+ sudo rm /var/db/ConfigurationProfiles/Settings/.cloudConfigRecordFound
+ sudo touch /var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled
+ sudo touch /var/db/ConfigurationProfiles/Settings/.cloudConfigRecordNotFound
+ break
+ ;;
+ "Disable Notification (Recovery)")
+ rm -rf /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigHasActivationRecord
+ rm -rf /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigRecordFound
+ touch /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled
+ touch /Volumes/Macintosh\ HD/var/db/ConfigurationProfiles/Settings/.cloudConfigRecordNotFound
+ break
+ ;;
+ "Check MDM Enrollment")
+ echo ""
+ echo -e "${GRN}Check MDM Enrollment. Error is success${NC}"
+ echo ""
+ echo -e "${RED}Please Insert Your Password To Proceed${NC}"
+ echo ""
+ sudo profiles show -type enrollment
+ break
+ ;;
+ "Exit")
+ echo "Rebooting..."
+ reboot
+ break
+ ;;
+ *) echo "Invalid option $REPLY" ;;
+ esac
+done
+复制完后退出Safari并打开终端(顶栏点击Safari浏览器弹出菜单选择退出,然后在顶栏选择实用工具➡️终端)
+打开终端后在终端粘贴刚刚复制的代码
+粘贴完后Enter,输入1然后一路Enter,完成后会显示两串蓝色的神秘字符显示Success
+成功后直接点左上角的苹果表重新启动
+重启后会显示账户,密码为1234,这个临时账户有管理员权限但是无法正常使用(漏洞创建的当然用不了)
登录进账户后打开启动台,打开“其他”文件夹并打开终端
+复制以下代码并粘贴到终端里
+关闭SIP:
+粘贴到终端Enter,然后可能会让你输入密码(就是1234),如果问你一串文字后面显示(y/N)输入y回车,总之一路回车即可
+跑完后如果显示“Enrollment configuration: We can't determine if this machine is DEP enabled.Tye again later.”
+就说明成功了
+成功后重启进恢复打开终端输入“csrutil disable”并回车
出现这样后输入Y回车,如果提示你enter password for user Mac:的提示就输入1234回车即可
+这样就成功了,完成后重启即可
+进入系统后就没有监管锁了,只需要在设置里创建一个管理员账户(一定得是管理员),然后到管理员账户里删除这个临时账户即可。
+到此这个教程就结束了,一些软件可以自行在客客邦里下载
+