Cybersecurity researchers have uncovered a sophisticated cyberattack where hackers installed a post-exploitation toolkit directly inside an Oracle database. The attackers gained full system-level control over the compromised server by exploiting a SQL injection vulnerability in a public-facing web application. This unusual technique allowed them to operate stealthily from within the database itself, making detection by standard security tools very difficult.[bleepingcomputer+2]
Attackers Exploit Old Vulnerability
The attack, discovered by cybersecurity firm Huntress on July 27, 2026, began with a common weakness: a SQL injection flaw.The vulnerability was found in a search engine feature of a public-facing Java application running on Apache Tomcat.This application failed to properly check user input, allowing the attackers to submit malicious SQL commands to the Oracle database.[bleepingcomputer+5]
Instead of just stealing data directly, the hackers took a more advanced approach. They used Oracle's built-in Java Virtual Machine (JVM) and a feature called `CREATE JAVA SOURCE`.This allowed them to compile and store their "khunt" toolkit as Java objects within the database's schema.These Java objects could then be executed using SQL commands, which, with the right permissions, could run commands on the host operating system.[bleepingcomputer+5]
"The use of the technique in the wild has rarely been documented," Huntress stated, highlighting the novelty and sophistication of this method.By embedding the toolkit within the database, the attackers avoided deploying traditional executable files on the server.This significantly reduced their digital footprint and made it harder for conventional endpoint security products to spot their malicious activities.[bleepingcomputer+5]
Inside the Khunt Toolkit
The "khunt" toolkit is a collection of Java components and PL/SQL wrappers designed for various post-exploitation tasks.It includes several modules with specific functions:[bleepingcomputer+1]
- KhuntCmd: This module launches the Windows command prompt (`cmd.exe`), allowing attackers to execute operating system commands directly through SQL statements.
- KhuntHash: This tool accesses Oracle's internal user tables to extract usernames and password data, which it then writes to a file.
- KhuntFS and KhuntFS2: These modules provide file system functionalities, such as browsing directories, reading files, searching for specific files, and checking file sizes on the compromised server.
- KhuntT: A simple "ping" tool used to confirm that the toolkit was successfully installed, operational, and reachable within the database.
- KhuntUnzip: This component allows the attackers to extract compressed files.
After deploying the toolkit, the attackers quickly moved to escalate their privileges. They used `KhuntCmd` to run the `cmd.exe /c whoami` command.This confirmed they had SYSTEM-level permissions on the Windows server, meaning they had complete control over the operating system.[bleepingcomputer+3]
Exploiting System Access
With SYSTEM-level access, the hackers proceeded to gather sensitive information. They used PowerShell and standard Windows utilities to copy critical registry hives: SAM, SECURITY, and SYSTEM.These files contain password hashes for local Windows accounts and are frequently targeted by attackers to recover user credentials.While Huntress noted these hives were likely exfiltrated for credential dumping, the report did not confirm if the files were successfully stolen.[bleepingcomputer+5]
The attackers also enumerated running services on the server by executing `tasklist /svc` and saved the output to a text file.This information helps them understand the system's configuration and identify further targets for lateral movement within the corporate network.This method of operating from inside the database makes it a "stealthy bastion host," as one Reddit user described it, allowing command and control traffic to be tunneled through standard Oracle SQL*Net protocol (port 1521), which often bypasses network-based detection rules.[bleepingcomputer+3]
Defense and Future Implications
This incident highlights that even decades-old vulnerabilities like SQL injection continue to pose serious risks when secure coding practices are not followed.A researcher at Algoritha Security emphasized this point.The attackers effectively turned the Oracle database from a data repository into a launchpad for further system compromise.[the420+4]
Security experts recommend several mitigation strategies to prevent such attacks. These include thorough input sanitization and query parameterization in web applications to prevent SQL injection.Implementing least-privilege configurations for database accounts is also crucial, ensuring that accounts cannot create Java objects or execute operating system commands without strict necessity.[daily+1]
Organizations should also deploy Database Activity Monitoring (DAM) solutions to detect unusual PL/SQL executions or Java calls within their databases.Network segmentation is vital to isolate database tiers, preventing them from having unrestricted outbound internet access.Finally, aggressive patching of Oracle databases and all connected web applications remains a fundamental defense against these sophisticated threats.[reddit+2]
