How can certutil.exe be used as a downloader in penetration testing?

certutil.exe can download files using the `-urlcache -split -f` flags, followed by the URL. For example, `certutil.exe -urlcache -split -f https://example.com/file.txt` saves the file with the same name, or you can specify a custom filename. It also supports binary files like DLLs and works on Windows XP through Windows 10. For more details, see certutil in Penetration Testing.