Attackers successfully exploited a SQL injection vulnerability to install a post-exploitation toolkit directly within an Oracle database, subsequently breaching a corporate network. The incident was detected by Huntress on July 27, 2026, after its security platform identified credential theft on a server hosting the compromised Oracle database.
Analysis of Apache access logs revealed that the attackers gained initial access through a vulnerable search engine endpoint in a public-facing Java application running on Apache Tomcat. The application's autocomplete search feature failed to properly validate user input, allowing the attackers to issue SQL commands to the Oracle database. Malicious requests were traced to the IP address 178.162.151[.]229.
Following the SQL injection, the attackers installed a post-exploitation toolkit named "khunt" directly into the Oracle database as a Java object. Oracle databases include an embedded Java Virtual Machine and support the `CREATE JAVA SOURCE` statement, which enables Java source code to be stored and compiled as a database schema object. These Java objects can then be executed via SQL commands and, if configured appropriately, can execute commands on the host operating system. The attackers leveraged this functionality to compile and store the khunt toolkit within the database itself, rather than deploying executable files on the server. This technique is rarely documented as being used in the wild.
The khunt toolkit comprised multiple Java components and PL/SQL wrappers designed for command execution, credential theft, and file management. Key components included: `KhuntCmd`, which launched `cmd.exe` to execute operating system commands via SQL statements; `KhuntHash`, which accessed Oracle's internal user table to write usernames and password data to a file; `KhuntFS` and `KhuntFS2`, providing file browsing, reading, searching, and file-size checking; `KhuntT`, a ping-like test to confirm toolkit installation; and `KhuntUnzip`, for extracting compressed files.
The attackers utilized `KhuntCmd` to run `cmd.exe /c whoami`, confirming that commands executed through the Oracle database had SYSTEM-level permissions on the Windows server. They then employed PowerShell and other Windows utilities to copy the SAM, SECURITY, and SYSTEM registry hives, which can be used to recover password hashes for local Windows accounts. Additionally, the attackers ran `tasklist /svc` to enumerate running services, saving the output to `khunttasks.txt`. While the registry hives were likely exfiltrated for credential dumping, it is unconfirmed whether the files were successfully stolen.
Organizations are advised to implement robust input validation for all user-supplied data and to restrict privileges granted to application database accounts. Specifically, database accounts used by public-facing applications should not possess sufficient privileges to create Java sources, execute unnecessary stored procedures, or perform other administrative actions.
