Hack and Decrypt WhatsApp Database (Remotely) [ROOT]

Posted by Max Si July 04, 2017

Hack and Decrypt WhatsApp Database (Remotely) [ROOT]

Maxdtricks

Hello my fellow hackers, it's been a while since my last post, I can't get the time now-a-days for the posts but can manage to tend to comments.

Welcome to my New post, this tutorial will explain how to extract and decrypt WhatsApp database from the Victim's android system.

Yes the device should be rooted, there is no way around to do this remotely. I have been getting PM's about this and can't simply answer with the word SPOOF.

WhatsApp?

Almost everyone knows about it. It is a social android application, that's enables the user to send free messages through the internet within seconds. The developers have made huge success and have high level and complex algorithms to encrypt and store the data, which changes with every update! And hence everyone uses it to send even the most personnel messages because they know it's safe.
But is it ?

Yes is it actually very safe, however if the Victim is a fool or gullible, he/she is the main vulnerability here. I see many of the 'experienced users' root their android to explore/push to the system's maximum limits. Following their footsteps the 'inexperienced users' also root/brick their android just to accomplish a minor task. They don't even care about the Cons.
Anyway, lets execute the hack:

Step 1 : Exploit and Gain Access to the Android !

This the easy part which you all like and are used-to.
Follow this guide to gain access to the Rooted android.

Once at meterpreter prompt, type check_root to make sure the device is rooted.

What Do We Require?

To decrypt the database, we need the database itself obviously and a key file in the /data folder, for which we need root to access the location. We cannot decrypt the database without the key (Until you want to spend more than 100 of years even with a mainframe!)

Step 2 : Let's Begin the Extraction Process for Database:

In meterpreter type:

cd /
cd /sdcard/WhatsApp
ls (Print the current directory)

cd Databases
download msgstore.db.crypt8 (This will take time, maybe a LOT)

So, the database has been downloaded, now we need to 'Key of Decryption'
(Key file that holds the encryption keys cannot be retrieved any-more unless your phone is rooted)

Step 3 : Drop into the Shell :

As told before, but adding a little more detail here:
To decrypt the crypt8 files, we will need the key file. The key file stores two sets of decryption keys – the actual encryption key,K and an initialisation vector called IV . WhatsApp stores the key file in a secure location.
Extracting the key file, type:

shell
su (For Super User access or simply escalating privileges)

Here comes the tricky part, if the target is experienced and skilled, he must have installed the SuperSU application.
The application is responsible for holding the permissions whether which application can have access to root. It even holds all the logs.
So, we need to convince the Victim that the application is for boosting (or any other reason) his/her android system but at the same time requires root access to reach it's maximum potential. Here is an excellent tutorial by bart that shows how to disguise a back-door application.