{"id":7420,"date":"2020-08-23T18:16:26","date_gmt":"2020-08-23T18:16:26","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=7420"},"modified":"2020-08-27T21:44:33","modified_gmt":"2020-08-27T21:44:33","slug":"certutil-one-more-gui-lolbin","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/08\/23\/certutil-one-more-gui-lolbin\/","title":{"rendered":"certutil &#8211; one more GUI lolbin"},"content":{"rendered":"\n<p>Cerutil is a very complex tool and only careful review of all its options allows us to comprehend its rich functionality. Lots of its command line arguments are described online all over the place and as such, what I present below is not new. However, AFAICT it has not been covered in a context of lolbining and as such, perhaps deserves some attention.<\/p>\n\n\n\n<p>Project <a href=\"https:\/\/lolbas-project.github.io\/lolbas\/Binaries\/Certutil\/\">LOLBAS<\/a> describes at least two ways of downloading files via certutil. Here is the third one:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">certutil -URL https:\/\/www.google.com<\/pre>\n\n\n\n<p>This will launch a GUI window for a program called URL Retrieval Tool:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/08\/certutil1.png\"><img decoding=\"async\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/08\/certutil1.png\" alt=\"\" class=\"wp-image-7421\" width=\"500\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/08\/certutil1.png 521w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/08\/certutil1-300x197.png 300w\" sizes=\"(max-width: 521px) 100vw, 521px\" \/><\/a><\/figure>\n\n\n\n<p>Once you hit Retrieve button you will get the &#8216;Failed&#8217; status, but&#8230; the file that URL points to will be now downloaded into %APPDATA%\\..\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\&lt;hash&gt; file (thx to <a href=\"https:\/\/twitter.com\/OsandaMalith\">@OsandaMalith<\/a> for pointing out a mistake in the path).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"720\" height=\"237\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/08\/certutil2.png\" alt=\"\" class=\"wp-image-7422\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/08\/certutil2.png 720w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/08\/certutil2-300x99.png 300w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cerutil is a very complex tool and only careful review of all its options allows us to comprehend its rich functionality. Lots of its command line arguments are described online all over the place and as such, what I present &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/08\/23\/certutil-one-more-gui-lolbin\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7420"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7420"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7420\/revisions"}],"predecessor-version":[{"id":7430,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7420\/revisions\/7430"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}