Move Mercurial option to advanced, update ref url

See rapid7#4440

Author: Tod Beardsley

modules/exploits/multi/http/git_client_command_exec.rb

@@ -46,9 +46,9 @@ def initialize(info = {})
       'References'     =>
         [
           ['CVE', '2014-9390'],
+          ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/01/01/12-days-of-haxmas-exploiting-cve-2014-9390-in-git-and-mercurial'],
           ['URL', 'http://git-blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html'],
           ['URL', 'http://article.gmane.org/gmane.linux.kernel/1853266'],
-          ['URL', 'https://community.rapid7.com/community/metasploit/blog/2014/12/30/12-days-of-haxmas-exploiting-cve-2014-9390-in-git-and-mercurial'],
           ['URL', 'https://github.com/blog/1938-vulnerability-announced-update-your-git-clients'],
           ['URL', 'https://www.mehmetince.net/one-git-command-may-cause-you-hacked-cve-2014-9390-exploitation-for-shell/'],
           ['URL', 'http://mercurial.selenic.com/wiki/WhatsNew#Mercurial_3.2.3_.282014-12-18.29'],
@@ -86,8 +86,7 @@ def initialize(info = {})
 
     register_options(
       [
-        OptBool.new('GIT', [true, 'Exploit Git clients', true]),
-        OptBool.new('MERCURIAL', [true, 'Exploit Mercurial clients', false])
+        OptBool.new('GIT', [true, 'Exploit Git clients', true])
       ]
     )
 
@@ -96,7 +95,8 @@ def initialize(info = {})
         OptString.new('GIT_URI', [false, 'The URI to use as the malicious Git instance (empty for random)', '']),
         OptString.new('MERCURIAL_URI', [false, 'The URI to use as the malicious Mercurial instance (empty for random)', '']),
         OptString.new('GIT_HOOK', [false, 'The Git hook to use for exploitation', 'post-checkout']),
-        OptString.new('MERCURIAL_HOOK', [false, 'The Mercurial hook to use for exploitation', 'update'])
+        OptString.new('MERCURIAL_HOOK', [false, 'The Mercurial hook to use for exploitation', 'update']),
+        OptBool.new('MERCURIAL', [false, 'Enable experimental Mercurial support', false])
       ]
     )
   end