HIGH Vulnerabilities #SQL Injection #Post Exploitation #Windows

khunt Toolkit Leverages SQLi in Oracle for SYSTEM Access

2026-08-06 10:29 UTC 4 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Attackers exploited SQL injection in a public-facing web app to gain SYSTEM access on Oracle Windows servers.
Affected systems include Oracle databases on Windows, vulnerable via SQL injection in connected Java applications.
Implement parameterized queries, input validation, and least privilege for database connection accounts immediately.

Overview of the khunt Toolkit and Oracle SQL Injection

Recent intelligence from Huntress details a critical attack chain where attackers exploited a SQL injection flaw in a public-facing web application to achieve SYSTEM-level code execution on underlying Windows servers hosting Oracle databases. This sophisticated technique involved compiling a post-exploitation toolkit, tracked as khunt, directly within the Oracle database as Java schema objects. By operating entirely within the database’s internal environment, the attackers bypassed traditional endpoint detection and response (EDR) mechanisms that typically monitor file system and process activity, effectively turning the database into a stealthy launchpad for further compromise. The initial breach was identified following credential-theft detections on July 27, 2026, highlighting the immediate impact and severe risk posed to organizations with similar configurations.

Technical Analysis: SQL Injection to SYSTEM Access Oracle

The attack originated from a SQL injection vulnerability in an autocomplete search field of a public-facing web application. This application passed unvalidated input to the Oracle database over a Java Database Connectivity (JDBC) connection. Crucially, the compromised database account behind this connection possessed sufficient privileges to create Java objects within the Oracle schema. This enabled the attackers to supply Java source code directly to the database, leveraging Oracle’s embedded Java Virtual Machine (JVM) to compile and store it as schema objects, completely circumventing the need to write executables to disk.

The khunt toolkit itself consisted of six Java objects and several khunt_* PL/SQL wrappers. Once compiled, these objects were executed from within the database engine. Attackers used these objects to run operating-system commands via Runtime.exec, evidenced by cmd.exe /c whoami returning SYSTEM privileges. This method is not new; it mirrors techniques dating back two decades, such as Marco Ivaldi’s 2006 raptor_oraexec.sql, which also demonstrated command execution and file reading via Oracle source objects.

Post-exploitation activities observed by Huntress included using PowerShell and reg.exe to copy SECURITY and SYSTEM registry hives to F:\Oracle, logging tasklist /svc output to khunttasks.txt, and copying SAM and SECURITY hives using esentutl.exe. While these files were staged locally, their exfiltration was not confirmed. The stealth of this approach makes how to detect khunt toolkit in Oracle a significant challenge for security teams, as EDR products typically do not inspect Oracle’s internal object structures.

Mitigating Oracle Java Stored Procedure Exploits

The fundamental weaknesses exploited were the application’s lack of input validation and the excessive privileges granted to the database service account. The malicious requests were traced to IP address 178.162.151[.]229.

Actionable Recommendations and Mitigations

To protect against this specific attack chain and similar threats, security professionals must prioritize a multi-layered defense strategy focused on application security and strict privilege management:

Implement Parameterized Queries and Input Validation: The most critical defense against SQL injection. Ensure all user-supplied input is rigorously validated at the application layer and that database interactions utilize parameterized queries or prepared statements. This prevents malicious input from being interpreted as executable SQL commands.
Enforce Least Privilege: Drastically reduce the privileges of database user accounts, especially those associated with public-facing applications. Accounts serving web applications should not possess system privileges such as CREATE PROCEDURE, the ability to author Java sources, or permissions to execute Runtime.exec. Oracle documentation specifies that file-execution permissions are typically restricted to highly privileged administrators; confirm no service accounts hold these excessive grants.
Enhance Internal Database Monitoring: Complement traditional endpoint security with deep database monitoring. Actively search Oracle installations for unusual schema objects, specifically those with names beginning Khunt. Review SQL audit logs for patterns like KHUNT% or other indicators of unauthorized Java object creation and execution from within the database. This internal vigilance is crucial given EDR limitations.
Conduct Regular Application Security Audits: Periodically audit all public-facing applications for common web vulnerabilities, with a specific focus on SQL injection and other OWASP Top 10 risks. Proactive scanning and penetration testing can uncover weaknesses before attackers exploit them.

#SQL Injection #Post Exploitation #Windows

X/Twitter LinkedIn Reddit HN

← Back to Articles