Hackers run khunt post-exploitation toolkit from Oracle database

Published:

5 augustus 2026 om 21:55:25

Alert date:

5 augustus 2026 om 22:02:16

Source:

bleepingcomputer.com

Database & Storage, Web Technologies, Enterprise Applications, Ransomware & Malware, Data Breach & Exfiltration

Hackers exploited a SQL injection vulnerability in an Oracle database to install the 'khunt' post-exploitation toolkit directly within the database environment. This technique allowed attackers to use the database itself as a launchpad for breaching a corporate network. The attack highlights the risk of SQL injection vulnerabilities in enterprise database systems being leveraged for advanced post-exploitation activities. By embedding malicious tooling inside the database, attackers can evade traditional endpoint detection mechanisms. The incident underscores the importance of database hardening, input validation, and monitoring for anomalous database activity in enterprise environments.

Technical details

Attackers exploited a SQL injection vulnerability in a public-facing Java application running on Apache Tomcat. The vulnerable endpoint was an autocomplete search feature that failed to properly validate user input, allowing SQL commands to be issued directly to the backend Oracle database. After gaining SQL injection access, the attackers installed a post-exploitation toolkit called 'khunt' by leveraging Oracle's embedded Java Virtual Machine and the CREATE JAVA SOURCE statement to store and compile Java source code as database schema objects. These Java objects were then executed via SQL commands with SYSTEM-level privileges on the underlying Windows server. The khunt toolkit consisted of multiple Java components and PL/SQL wrappers: KhuntCmd (executed OS commands via cmd.exe), KhuntHash (accessed Oracle's internal user table and dumped usernames/password data to a file), KhuntFS and KhuntFS2 (file browsing, reading, searching, and size-checking), KhuntT (installation verification ping-like test), and KhuntUnzip (extraction of compressed files). Attackers confirmed SYSTEM-level execution by running 'cmd.exe /c whoami'. They then used PowerShell and Windows utilities to copy the SAM, SECURITY, and SYSTEM registry hives for offline credential dumping, and ran 'tasklist /svc' to enumerate running services, saving output to khunttasks.txt. Registry hives were likely exfiltrated but not confirmed. The attack was discovered by Huntress on July 27, 2026.

Mitigation steps:

1. Sanitize and validate all user-supplied input, particularly in search/autocomplete endpoints, to prevent SQL injection. 2. Restrict database account privileges for public-facing applications: accounts should not have permission to CREATE JAVA SOURCE objects, execute unnecessary stored procedures, or perform administrative actions. 3. Audit Oracle database schemas for unexpected Java source objects or PL/SQL wrappers. 4. Review Oracle database logs for use of CREATE JAVA SOURCE statements and unusual SQL command patterns. 5. Monitor Apache Tomcat access logs for suspicious or malformed requests to search/autocomplete endpoints. 6. Block or investigate traffic from IP address 178.162.151[.]229. 7. Monitor for unexpected access to SAM, SECURITY, and SYSTEM registry hives. 8. Search for files named khunttasks.txt or similar artifacts on Oracle database servers. 9. Implement least-privilege principles for all database service accounts. 10. Consider disabling Oracle's Java execution capabilities if not required for business operations.

Affected products:

Oracle Database (with embedded JVM)
Apache Tomcat (public-facing Java application)
Windows Server (hosting Oracle database)