A post-exploitation toolkit has been discovered compiled and stored within an Oracle database as schema objects, allowing attackers to execute commands on the underlying Windows server from a location typically not inspected by conventional endpoint security tools.
The intrusion was detected by Huntress on July 27, following credential theft alerts on a host running an Oracle database server. The cybersecurity firm published its analysis of the incident on August 5. The initial access point was a SQL injection vulnerability in the autocomplete search feature of a public-facing Java application utilizing Apache Tomcat. This was not a vulnerability in the database itself, but rather an issue with the application passing unvalidated input to the database over a Java Database Connectivity (JDBC) connection, using an account that possessed permissions to create Java objects.
Oracle databases include an embedded Java Virtual Machine (JVM) and a mechanism to store Java source code as a database object. The attacker exploited the SQL injection to feed malicious Java code through this mechanism, which Oracle then compiled into stored schema objects, forming the toolkit.
The toolkit, named "khunt" based on its module names and written files, comprised several components. These included a module capable of opening a Windows command shell for arbitrary operating system commands, and a credential dumper designed to read Oracle's internal user table and write usernames and passwords to a file. Additionally, the toolkit featured two file explorers, an unzip utility, a reachability check to confirm its operational status, and a set of PL/SQL wrappers to invoke the underlying Java methods. While the technique of compiling code within a database is not new, Huntress highlighted its use in this specific attack as a novel aspect, noting its rare documented appearance in the wild.
The attackers leveraged the database as a pivot point to the operating system by opening a Windows command shell, confirming they had achieved SYSTEM-level privileges. They then used PowerShell to interact with the Windows registry, copying the SECURITY and SYSTEM hives. Further enumeration of running services was performed, and the SAM and SECURITY hives were copied using the Extensible Storage Engine utility. Huntress assessed that these hives were staged for credential dumping and potential exfiltration, categorizing this activity as an attempt rather than confirmed theft. Apache access logs enabled researchers to trace the malicious requests back to a single IP address.
Huntress emphasized the detection challenge posed by this method. Storing the toolkit as a database object, rather than a file or a memory-resident payload, places it outside the typical scope of most security tools. Endpoint protection products primarily focus on processes, binaries, and files, rather than Java classes and PL/SQL wrappers embedded within an Oracle database. This approach effectively transforms the database from a data repository into an operational foothold for attackers.
To mitigate such attacks, Huntress advises ensuring that application forms are not susceptible to injection vulnerabilities. This requires implementing proper input sanitization and query parameterization for all user inputs. Furthermore, it is crucial to ensure that database users with the ability to execute queries are not over-provisioned with excessive permissions.
