In theory, it should be just a matter of fetching /tor/rendezvous2/<hidden service identity> via HTTP from the hidden service directory responsible for that hidden service, as per the rend spec, in particular section 1.6.
In practice, you need to find the right server to download it from and then form the request correctly. That's a bit icky to do manually. There is a script by DonnchaC, retrieve_hs_descriptor, which depends on Stem and helps with that part.
As an example, right now the descriptor for the DuckDuckGo hidden service can be found, among other places, at
http://64.31.47.121:9030/tor/rendezvous2/yj446zqor4cczgxzl3kgtmdbfgwkj6de
and looks like this:
rendezvous-service-descriptor yj446zqor4cczgxzl3kgtmdbfgwkj6de version 2 permanent-key -----BEGIN RSA PUBLIC KEY----- MIGJAoGBAJ/SzzgrXPxTlFrKVhXh3buCWv2QfcNgncUpDpKouLn3AtPH5Ocys0jE aZSKdvaiQ62md2gOwj4x61cFNdi05tdQjS+2thHKEm/KsB9BGLSLBNJYY356bupg I5gQozM65ENelfxYlysBjJ52xSDBd8C4f/p9umdzaaaCmzXG/nhzAgMBAAE= -----END RSA PUBLIC KEY----- secret-id-part a2pcyuhciqsrah34benwufa54aandwzh publication-time 2013-10-01 15:59:47 protocol-versions 2,3 introduction-points -----BEGIN MESSAGE----- aW50cm9kdWN0aW9uLXBvaW50IGkzdWJoazQzc3RranZlenpmZmlnaXc3ZzRmbmV4 bHI3CmlwLWFkZHJlc3MgNzguNDYuNTEuMjMzCm9uaW9uLXBvcnQgNDQ0Cm9uaW9u LWtleQotLS0tLUJFR0lOIFJTQSBQVUJMSUMgS0VZLS0tLS0KTUlHSkFvR0JBTWpz NnZZRmhURWI0U1dTNzd3K3pvMEVrMDFub083cU1aODU0cEtadEt4T2pDSGF1bGhK V29sTApnYlZwZnpQQVpZeVhoSUJkRW9tK2dabDFyZXhrRE9nTmt2eXNBMHd3cmNS dk5waklUM3dVYVFhdHlIczIrSnZVCmhzMitzZVY1OXQ2dEZER2VESVdJRHRQVmE0 Q2ZCbUNzSFpiU09aQVFHeUVyNEdHOG9HRjNBZ01CQUFFPQotLS0tLUVORCBSU0Eg UFVCTElDIEtFWS0tLS0tCnNlcnZpY2Uta2V5Ci0tLS0tQkVHSU4gUlNBIFBVQkxJ QyBLRVktLS0tLQpNSUdKQW9HQkFOcDM2TlYzeW5GQzd3YTZVbVBaR3psOUI0ejRp NnpseUVqcXAxZ05vRUIrdmJHbk5yT2x2SDdaCm9pSnVIWlArbTQzNVhNOG1mWGdV aytxRVp3RFNMUG41QytiNDRjUiszMWNUOEhZSDNSeUZtVk14YStFSXRmT0MKckN1 QTBPYmJKNE45L2YxU0hRdmxHVmpLalZxci9JQU5TK2MzMnZDbGxxSU5CM0VVdXVj QkFnTUJBQUU9Ci0tLS0tRU5EIFJTQSBQVUJMSUMgS0VZLS0tLS0KaW50cm9kdWN0 aW9uLXBvaW50IHVndW9mcmx5YXI3ZWloemVjbGVycmZoY3BiaXhudGhqCmlwLWFk ZHJlc3MgMTczLjIxMy43OC4xMjYKb25pb24tcG9ydCA4MApvbmlvbi1rZXkKLS0t LS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JR0pBb0dCQUowa1JMZjNKQ2Fa KzRodENMenFBNzBKUlFZb1dHWFg1a21zOUoxblI1VmoyUDRyRFc4eEhrVGoKeStK Z2NmMFlScmVYZVRMN2pyWmhBUlVjc2hBZDl3a1ZVTXR6N3ZlUGlVbVZFVm44aEN2 SUFnZjFGMkN5STAxQgp1WTJRZ01SUHEzYXZOd2RQUzdSbHVCemdSbXNBQjh6bGw0 QkhObTFNSTJhbHJKY2tXZDRSQWdNQkFBRT0KLS0tLS1FTkQgUlNBIFBVQkxJQyBL RVktLS0tLQpzZXJ2aWNlLWtleQotLS0tLUJFR0lOIFJTQSBQVUJMSUMgS0VZLS0t LS0KTUlHSkFvR0JBUDVGNnNQZ25BdHY0VDFKVlRUc3RBcytkUjVjVWpFdmxBS1Z0 d3M5NTVHQUVXUm1CZkp1a3BVKwplV3A4MENsbml1VGVPeW14VG01L0xlZlNBNGdl YnVNcjgxc3gvYzNMTG1lTmNKZnZsWjl0VitjRnlXdEg2OXRiCkV2RXFhWFl0UGpZ cnhQUXVzeWNBZVkxRW1NTGJLdXRhZ1ZlSzNnaWFMSTZ2K2VjL0VxekJBZ01CQUFF PQotLS0tLUVORCBSU0EgUFVCTElDIEtFWS0tLS0tCmludHJvZHVjdGlvbi1wb2lu dCAycHNoNnpnZWNuYXE2amZuZXdtcWxtZnhqYmN0ejZyNAppcC1hZGRyZXNzIDUu MTk5LjE0Mi4xOTUKb25pb24tcG9ydCA5MDAxCm9uaW9uLWtleQotLS0tLUJFR0lO IFJTQSBQVUJMSUMgS0VZLS0tLS0KTUlHSkFvR0JBTjFkNXZqN0xkQkttT0NIaWJ0 VTNyMlBrQVpsenV3L0RDbmRMc2IrMkRnVG90eTRjU1Rjc2E4dAo2TlI0WEN5Tith N1JURis2Q3dSdnJpUnZ1K0ZwQVEwdUIzV2tkUENCTDVreHJXT1d5V0t6Lzk1blU3 Vlo3cEVMCmNqbktmVVZOMnl0Qng2dWJ3S2lUSktqek51cjA1N0g3MmdoQmRPZlR1 bE9STjhqdWZqb3BBZ01CQUFFPQotLS0tLUVORCBSU0EgUFVCTElDIEtFWS0tLS0t CnNlcnZpY2Uta2V5Ci0tLS0tQkVHSU4gUlNBIFBVQkxJQyBLRVktLS0tLQpNSUdK QW9HQkFKNGw5M2pHa1ZoOXp5czZvNkR6aGJudTBoem1jT3dOOFJCUU9JWUU1S2tK NzNxNjkxaXdTaHkxCnJ6K3pQQXJiOEJ0aHNxZmhhWjNucHBCNHNnYVhuRHJUR2FE Vjh5bVk1UVVBaGtWSnRkcnRGcmNROFJVTGVsbFcKZFNPZ2VKamNKRnZESkdCdWgz MzBjcmRIN295Q045Q1BISm1SUWs4VXNHbnpiMzdKbXM3eEFnTUJBQUU9Ci0tLS0t RU5EIFJTQSBQVUJMSUMgS0VZLS0tLS0KCg==//OUTPUT CUT -----END MESSAGE----- signature -----BEGIN SIGNATURE----- VEToDAxw1X77NwcM6/DG+I3uu8lLlFpI//rUHjLRC0unA7kRp6xY4E6xpcbl4KUX EUUkJ3hXhmB3gFAjUkk70IDr5HIP86Z/ZTl6WvbTFWYLUPJQtt08XSmY788FG1lA nTnNbqms5Nt5HKsG5khZf5viIuU3ei+u0SIv3gHy3JY= -----END SIGNATURE-----
Note that for servers running a Tor version 0.2.4.x or 0.2.3.23 or later, the answer is even trickier. Such servers, when acting as hidden service directories, will require these HTTP requests to be done via an encrypted connection, i.e. over Tor and not using plain-text HTTP. So that makes it a bit more tricky. The easiest approach might be to modify Tor and have it dump HS descriptors when you fetch them.
Otherwise you could use Stem get_hidden_service_descriptor function. The following python script will print the HS descriptor for the onion address passed as command line parameter.
import sys
from stem.control import Controller
with Controller.from_port(port = 9051) as controller:
controller.authenticate()
print(controller.get_hidden_service_descriptor(sys.argv[1]))
