{"id":7428,"date":"2020-08-30T23:43:33","date_gmt":"2020-08-30T23:43:33","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=7428"},"modified":"2020-08-31T22:35:10","modified_gmt":"2020-08-31T22:35:10","slug":"certulitis-one-tool-that-keeps-on-giving","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/08\/30\/certulitis-one-tool-that-keeps-on-giving\/","title":{"rendered":"Certulitis – one tool that keeps on giving"},"content":{"rendered":"\n

Update<\/strong><\/p>\n\n\n\n

EC who is one of the most technical guys I know pinged me because he figured out the meaning of that 0x00FB switch, The idea behind it is Windows archeology at its best and it goes as follows:<\/p>\n\n\n\n

The code page your windows terminal uses is 437. Endash (‘\u2013’) is an ASCII character 150 (0x96). When this character is inputted on terminal using code page 437 it will be mapped to ‘\u00fb’ which is code 0xFB.<\/p>\n\n\n\n

How to use it with certutil?<\/p>\n\n\n\n

You can run:<\/p>\n\n\n\n

certutil ALT+150<command of your choice><\/pre>\n\n\n\n
Old Post<\/strong><\/p>\n\n\n\n
Certutil is a really naughty<\/a> tool. It accepts lots of various command line arguments that I believe are not widely known – and this post (and maybe some follow-up posts) is hoping to change that.<\/p>\n\n\n\n
One of the first things I caught when I started analysing its command line arguments was the mysterious, case-insensitive command line argument comparison with the ‘uSAGE’ string. It turns out that certutil offers two different usage information depending on a command line option. If you just use ‘?’ then it’s the ‘official’ version. If it’s ‘uSAGE’ then it’s the unofficial one. Of course, once I found out I ran into Google and Twitter to find out if it is IN THE KNOWN. <\/p>\n\n\n\n
Yes, it was. @0gtweet<\/a> did it my favourite way – the hard way<\/a> :-), @dunarth<\/a> did it the right way, and @chris_ayres<\/a> did it the earliest<\/a> way (AFAICT).<\/p>\n\n\n\n
Okay, with this out of the way, we look at the actual command line arguments.<\/p>\n\n\n\n
Wait. What about the command line switches? Similarly to PowerShell, certutil accepts command line arguments using a number of different characters:<\/p>\n\n\n\n