Decrypt the cookies stored by the MS Teams desktop client

Question

I am creating a digital forensic tool that gets all data of user from different platforms. I successfully have done extraction for Teams website but I am unable to do so for the desktop app. So far, I know that the cookies are stored in Local/Microsoft/Teams folder. The file has no extension although it is an SQLite3 database. It shows all the cookies but these are in encrypted form. Is there any way I can get the actual decrypted cookies?

1. If the server encrypts cookies, it does not mean that the client is able to decrypt them. The client must just send back all the cookies to the server.

The server is not encrypting instead the client desktop app is. The Microsoft API use plain cookies. And I can not use the encrypted ones in browser as that will not start session.

1. Why do you think they are encrypted in the first place instead of just being some identifier into a backend database with the actual data?

2. What makes you think that the client (and thus your tool) would have access to the key to decrypt the data - wouldn't this defeat the purpose of encryption in the first place?

I think they are encrypted because they are under the column "encrypted value".

I have found a library that decrypts cookies stored by chrome and other browsers. I think we can decrypt the MS Teams cookies if we have the keys for it using the following code

import browser_cookie3

c = browser_cookie3.chrome(cookie_file=r"C:\Users\Farhan Ahmed\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Cookies",
                            key_file="Key file")

for cookie in c:
    print(cookie.name, end=" ")
    print(cookie.value)

The code does not work for now and give some errors. I am checking why that is happening.

I will appreciate if someone shares a better way of doing it.

Answer 1

Just so you know, I think this has already been done - https://github.com/sleuthkit/autopsy_addon_modules/tree/master/IngestModules/Microsoft_Teams_Parser

You could just browse the code at https://github.com/lxndrblz/forensicsim/ to get an understanding of how the Teams data is stored.