An alarming security breach has been traced back to a simple vulnerability within a web application, allowing hackers to compromise a Windows Server. Using SQL injection, the attackers implanted a remote-control toolkit into an Oracle database, highlighting a significant risk to systems with insecure input validation.
The attack exploited a public-facing Java and Tomcat application linked to an Oracle database. Through an improperly secured autocomplete function, the attackers injected database commands, enabling them to manipulate the system and set up further stages of their attack.
How the Attack Unfolded
Researchers from Huntress discovered this breach while investigating attempts to extract credentials from a server hosting Oracle. Their analysis revealed that the attackers had accessed critical Windows registry files, such as SAM, SECURITY, and SYSTEM, which could be used to extract password hashes and expand their access.
Rather than leaving traditional malware files on the disk, the attackers stored and compiled the malicious code within Oracle. This method made it difficult for conventional endpoint detection tools to identify the threat before the attackers could gain control over the Windows host.
Exploiting Oracle’s Java Capabilities
The intruders utilized Oracle’s built-in Java functionality to create Java source objects directly inside the database. By sending commands via the application’s JDBC connection, they transformed the database into a covert launch pad, rather than merely a repository for business data.
The toolkit, named ‘khunt’, was equipped to execute Windows commands, gather Oracle credentials, browse files, and ensure the toolkit’s activity remained undetected. This database-centric approach allowed the attackers to explore the server without relying on conspicuous executable files.
Securing Databases Against Future Threats
Organizations are urged to scrutinize public forms and search fields capable of accessing databases, particularly legacy features that might be neglected in testing phases. Input validation and query parameterization should be standard practices to prevent SQL injection attacks.
Database accounts should be limited to essential permissions only. Web applications should not have access to create Java objects or execute sensitive procedures, minimizing potential damage even if an injection vulnerability is exploited.
Security teams should conduct thorough searches for unexpected Java classes in database objects, review PL/SQL wrappers, and assess web and SQL logs for anomalies. Keeping abreast of security updates, such as those from Microsoft, is crucial for defending against these types of threats.
For incident response, prioritizing the search for unusual Oracle-generated files, unexpected database objects, and any signs of oracle.exe spawning command-line or registry tools is recommended. Systems should be isolated, credentials reset, and logs preserved for forensic analysis to restore trust in the compromised host.
