Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers exploited a SQL injection vulnerability in a public-facing web application to gain access to an Oracle database, then leveraged Oracle's embedded Java Virtual Machine to compile and execute malicious Java code within the database itself. This post-exploitation toolkit, tracked as khunt by Huntress, allowed the attackers to achieve SYSTEM-level privilege escalation on the underlying Windows server without writing files to disk. The toolkit consists of multiple Java classes and PL/SQL wrappers that enable command execution, credential theft, file system access, and registry hive extraction. The malicious activity was traced to a single IP address, and detection requires hunting for specific object names and SQL patterns due to the in-memory nature of the attack.

AI-extracted · verify before operational use