Attackers Compile 'khunt' Toolkit Inside Oracle Database for SYSTEM-Level Access
Threat actors exploited a SQL injection vulnerability to deploy a Java-based post-exploitation toolkit directly within an Oracle database, enabling SYSTEM-level command execution on the underlying Windows server without writing executables to disk.
Security researchers have uncovered a sophisticated attack method where threat actors leveraged a SQL injection flaw in a web application to gain access to an Oracle database. Once inside, they compiled Java source code into stored schema objects, effectively creating a post-exploitation toolkit named 'khunt'. This novel approach allowed them to execute commands directly from within the Oracle database engine, ultimately achieving SYSTEM-level privileges on the compromised Windows server.
The initial compromise stemmed from a SQL injection vulnerability within a public-facing web application. An autocomplete search field in this application passed unvalidated user input to the database via a Java Database Connectivity (JDBC) connection. Crucially, the database account associated with this connection possessed sufficient privileges to create Java objects, a capability that attackers exploited to their advantage.
Huntress, a cybersecurity firm that tracked the toolkit as 'khunt', began its investigation after detecting credential theft indicators on July 27, 2026. Their analysis traced the attack chain from the initial SQL injection to the execution of commands with SYSTEM privileges on the underlying Windows server. The attackers' ability to compile and run Java code within the Oracle database bypassed traditional endpoint security measures, as the malicious code existed as schema objects rather than executable files on the filesystem.
This technique relies on Oracle's embedded Java Virtual Machine (JVM). The CREATE JAVA SOURCE statement allows users to submit Java code, which the database then compiles and stores as a schema object. While Oracle's documentation indicates that executing operating-system processes from such code typically requires specific file-execution permissions, the compromised account in this incident apparently held sufficient grants to perform both the Java object creation and the subsequent process execution via Runtime.exec.
The 'khunt' toolkit itself comprised six Java objects and several PL/SQL wrappers. These components were designed for various post-exploitation activities, including executing arbitrary operating-system commands (KhuntCmd), reading user credentials and password hashes from Oracle's internal tables (KhuntHash), listing and manipulating files (KhuntFS and KhuntFS2), confirming toolkit reachability (KhuntT), and unpacking archives (KhuntUnzip).
During their investigation, Huntress observed attackers using KhuntCmd to execute whoami, which returned 'SYSTEM', confirming their elevated privileges. Subsequently, the attackers employed tools like PowerShell and reg.exe to copy critical registry hives (SECURITY and SYSTEM) and used esentutl.exe to extract SAM and SECURITY hives, likely in preparation for further lateral movement or data exfiltration. While files were staged locally, Huntress did not confirm exfiltration.
This method of weaponizing database internals is not entirely new, with similar techniques documented as far back as 2006. However, its use in the wild has been rarely observed. The primary defense against such attacks involves implementing robust input validation and parameterized queries in web applications to prevent SQL injection. Additionally, enforcing the principle of least privilege for database accounts, especially those serving public-facing applications, is crucial to prevent unauthorized object creation and code execution.