I confirm @Daniel Ballinger's solution: http://salesforce.stackexchange.com/a/44800

The OAuth scope needed is "web: Provide access to your data via the Web (web)".

Steps to download a Rich Text Area (RTA) image via OAuth and curl:

 1. Make sure you have the correct scope for your OAuth access token. Go to the "Connected Apps" page for your OAuth connected app in Salesforce. Under "API (Enable OAuth Settings)" make sure the scope "web: Provide access to your data via the Web (web)" is included.
 2. If you were using an old refresh token with the old scope, re-authorize and get a new one with the new scope which includes "web".
 3. Get the URL of the RTA image by browsing the Knowledge article or otherwise, it should look like https://example--c.eu3.content.force.com/servlet/rtaImage?eid=ka0w0000000U2CV&feoid=00Nw0000008eLoi&refid=0EMw00000004lzh
 3. Make a curl request setting your cookie "sid" to the OAuth access token value e.g.

    curl -ik --cookie 'sid=MyOauthAccessToken' 'https://example--c.eu3.content.force.com/servlet/rtaImage?eid=ka0w0000000U2CV&feoid=00Nw0000008eLoi&refid=0EMw00000004lzh'
 4. You will get a 302 redirect, do another curl with the redirect URL and set the same "sid" cookie value. Follow 3-4 subsequent redirects, using the returned redirect URL each time, until the response header includes a "Set-Cookie" giving you a new "sid" cookie value.
 5. Use the new "sid" cookie value for the next request.
 6. The request with the new "sid" cookie value will get you the binary data of the image.