Oracle Database Exploited

Overview

On July 27, 2026, Huntress researchers uncovered a sophisticated attack where hackers exploited a SQL injection vulnerability to install the khunt post‑exploitation toolkit directly inside an Oracle database. This unusual technique leveraged Oracle’s embedded Java Virtual Machine to compile and store malicious Java objects as schema components, giving attackers SYSTEM‑level control of the host server.

Attack Chain

• Initial access: Exploited a vulnerable autocomplete search feature in a Java application running on Apache Tomcat.
• Toolkit installation: Used Oracle’s CREATE JAVA SOURCE statement to embed khunt as Java objects.
• Execution: SQL commands triggered the toolkit, enabling OS‑level actions.
• Privilege abuse: Attackers confirmed SYSTEM‑level permissions by running cmd.exe /c whoami.

Khunt Toolkit Components

• KhuntCmd: Launched cmd.exe to execute OS commands.
• KhuntHash: Extracted usernames and password data from Oracle’s internal user table.
• KhuntFS / KhuntFS2: Provided file browsing, reading, and searching capabilities.
• KhuntT: Ping‑like test to confirm installation success.
• KhuntUnzip: Extracted compressed files.

Attackers used KhuntCmd to run PowerShell and Windows utilities, copying SAM, SECURITY, and SYSTEM registry hives for credential dumping. They also enumerated services with tasklist /svc, saving results to khunttasks.txt.

Impact

• SYSTEM‑level access allowed attackers to potentially exfiltrate registry hives and dump credentials.
• Attackers gained file management and command execution capabilities directly through the database.
• Huntress noted that this rarely documented technique bypasses traditional detection since the payload resides inside the database schema rather than on disk.

Defensive Guidance

• Sanitize user input: Validate and escape all user‑supplied data.
• Restrict database privileges: Public‑facing applications should not have rights to create Java sources or execute administrative procedures.
• Monitor unusual Java objects: Audit schema objects for suspicious code.
• Limit registry access: Detect attempts to copy SAM, SECURITY, and SYSTEM hives.
• Apply least privilege: Ensure accounts only have permissions necessary for their role.

Expert in the Cloud Insight

The khunt campaign illustrates how attackers are weaponizing legitimate database features to embed post‑exploitation toolkits. By hiding malicious code inside Oracle schema objects, they bypass traditional endpoint defenses and gain SYSTEM‑level control. For defenders, the lesson is clear: databases are not just data stores — they can become execution platforms if privileges are misconfigured.