In a recent cybersecurity incident, attackers successfully breached an organization’s Oracle database through a SQL injection vulnerability present in a web application. The attackers then utilized an advanced toolkit, transforming the database into a platform for further exploitation without leaving any executable files on disk. This breach was made possible by feeding Java source code directly into the database, allowing Oracle to compile and execute it as stored schema objects.
Exploiting SQL Injection for SYSTEM Access
The investigative team at Huntress, who have been tracking this toolkit under the name ‘khunt,’ began their inquiry following the detection of credential theft on July 27, 2026. Their investigation revealed that the exploit led to SYSTEM-level code execution on the Windows server hosting the Oracle database.
The vulnerability was traced to an autocomplete search field within the application, where unvalidated inputs were transmitted to the database via Java Database Connectivity (JDBC). The account used for this connection possessed sufficient privileges to create Java objects, which was a critical factor in the exploitation process.
Understanding the Toolkit and Vulnerabilities
Currently, there is no Oracle patch available to address the application flaw or the excessive account privileges that facilitated the attack. Identifying the toolkit requires searching the Oracle installation for object names starting with ‘Khunt’ and examining SQL logs for the ‘KHUNT%’ pattern.
Oracle’s embedded Java Virtual Machine and the CREATE JAVA SOURCE statement played pivotal roles in this attack. The database was used not just as a query processing tool but as a foothold for further system compromise. The required privilege for this attack is the CREATE PROCEDURE, with additional permissions needed to execute operating-system processes.
Historical Context and Attack Implications
This method of exploitation is not new. It dates back to at least 2006 with techniques like Marco Ivaldi’s raptor_oraexec.sql, which allows command execution through Oracle database objects. The current khunt toolkit employs a similar architecture, albeit its use in real-world attacks has been rarely documented.
The toolkit comprises six Java objects and several PL/SQL wrappers, each serving distinct functions such as executing commands, reading user data, and manipulating files. For instance, ‘KhuntCmd’ runs system commands, while ‘KhuntHash’ extracts username and password hashes.
Despite observing local file staging, Huntress has not confirmed data exfiltration. No specific threat actor has been identified, though malicious activities were traced to an IP address 178.162.151[.]229.
Preventative Measures and Future Outlook
Security experts advocate for the use of parameterized queries and rigorous input validation to prevent such vulnerabilities. Additionally, enforcing least privilege principles is crucial; accounts used for public applications should not have the capability to author Java sources or execute unnecessary stored procedures.
This incident underscores the importance of robust database security practices and continuous monitoring to detect and respond to potential threats effectively.
