Full Report
Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. [...]
Analysis Summary
# Tool/Technique: khunt Post-Exploitation Toolkit
## Overview
**khunt** is a post-exploitation toolkit developed in Java and PL/SQL, specifically designed to reside and execute within an Oracle Database environment. By leveraging Oracle's embedded Java Virtual Machine (JVM), the toolkit allows attackers to execute OS-level commands, manage files, and harvest credentials directly through SQL statements, bypassing traditional file-based detection by existing as a database schema object.
## Technical Details
- **Type:** Post-exploitation Tool / Malware Framework
- **Platform:** Oracle Database (running on Windows/Linux host OS)
- **Capabilities:** OS command execution, credential theft, file system manipulation, and persistence via database objects.
- **First Seen:** July 27, 2026 (Reported by Huntress)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (SQL Injection)
- **[TA0002 - Execution]**
- [T1202 - Indirect Command Execution]
- [T1059.001 - PowerShell]
- **[TA0003 - Persistence]**
- [T1505.001 - Server Software Component: Database Stored Procedures]
- **[TA0006 - Credential Access]**
- [T1003.002 - OS Credential Dumping: Security Account Manager]
- [T1606 - Forge Web Credentials] (Oracle User Tables)
- **[TA0007 - Discovery]**
- [T1057 - Process Discovery]
- [T1083 - File and Directory Discovery]
## Functionality
### Core Capabilities
- **KhuntCmd:** Launches `cmd.exe` to execute host operating system commands via SQL.
- **KhuntHash:** Accesses Oracle internal user tables to extract usernames and password data.
- **KhuntT:** A connectivity and installation verification "ping" tool.
### Advanced Features
- **In-Memory/Database Residence:** Uses `CREATE JAVA SOURCE` to store and compile code as a schema object, avoiding the need for on-disk binaries.
- **KhuntFS / KhuntFS2:** Advanced file system interaction including searching, reading, and size verification.
- **KhuntUnzip:** Utility to decompress files directly on the target host.
- **Privilege Escalation:** Inherits the permissions of the Oracle service (often SYSTEM on Windows).
## Indicators of Compromise
- **File Names:**
- `khunttasks.txt` (Output of tasklist)
- `sam`, `security`, `system` (Registry hive copies in temp locations)
- **Network Indicators:**
- `178.162.151[.]229` (Attacker source IP)
- **Behavioral Indicators:**
- Oracle process (`oracle.exe`) spawning `cmd.exe` or `powershell.exe`.
- Unusual SQL commands involving `CREATE JAVA SOURCE` or `dbms_java`.
- Access to `C:\Windows\System32\config\` by non-system processes.
## Associated Threat Actors
- **Unknown:** Currently tracked as an unidentified group exploiting Java-based Apache Tomcat applications.
## Detection Methods
- **Signature-based detection:** Monitor Oracle Database logs for the string "khunt" within Java source definitions or PL/SQL wrappers.
- **Behavioral detection:**
- Monitor for `whoami` or `tasklist` commands originating from database service accounts.
- Detect unauthorized copying of Windows Registry hives (SAM/SECURITY/SYSTEM).
- **Log Analysis:** Scrutinize Apache/Tomcat access logs for SQL injection patterns (e.g., `'`, `--`, `UNION SELECT`) targeting autocomplete or search endpoints.
## Mitigation Strategies
- **Input Validation:** Implement strict allow-lists for all user-supplied input in web applications to prevent SQL injection.
- **Principle of Least Privilege (PoLP):**
- Restrict the database user account used by web applications so it cannot execute `CREATE JAVA SOURCE` or `CREATE PROCEDURE`.
- Disable the Oracle JVM if it is not required for business logic.
- **Egress Filtering:** Block outbound connections from database servers to unknown external IPs.
- **Patch Management:** Ensure Apache Tomcat and associated Java applications are patched against known vulnerabilities.
## Related Tools/Techniques
- **SQL Injection (SQLi):** The primary delivery mechanism.
- **OVAL (Oracle Virtual Machine):** The underlying technology abused for execution.
- **Laudanum:** A collection of injectible files for various environments (similar concept).
- **Database Web Shells:** Similar to web shells but residing within DB stored procedures.