Full Report
See how a SQL injection bug led to full OS-level RCE, as attackers abused Oracle Java Source to deploy the khunt post-exploitation toolkit.
Analysis Summary
# Incident Report: SQL Injection Leading to RCE via Oracle Java Source
## Executive Summary
An organization's public-facing Java/Tomcat application was compromised via a classic SQL injection (SQLi) vulnerability. The attacker leveraged Oracle’s embedded Java Virtual Machine (JVM) to deploy a novel post-exploitation toolkit named `khunt` directly into the database schema. This resulted in full OS-level Remote Code Execution (RCE) and the attempted theft of critical Windows registry hives.
## Incident Details
- **Discovery Date:** July 27, 2026
- **Incident Date:** July 27, 2026
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** July 27, 2026
- **Vector:** SQL Injection (SQLi)
- **Details:** Attackers exploited a public-facing web form that lacked proper input validation. By submitting malicious SQL commands through a Tomcat/JDBC connection, they gained unauthorized access to the backend Oracle database.
### Lateral Movement
- The attacker used the `CREATE JAVA SOURCE` command to upload and compile Java code directly within the Oracle database engine. This allowed them to transition from database-level access to operating system-level execution.
### Data Exfiltration/Impact
- The attackers attempted to exfiltrate the `SAM`, `SECURITY`, and `SYSTEM` registry hives from the host Windows server to dump credentials and escalate privileges.
### Detection & Response
- **Detection:** Huntress MDR alerted on suspicious activity where `oracle.exe` spawned `reg.exe` to access sensitive registry hives.
- **Response:** Analysts investigated Apache `access.log` files and Oracle database objects to identify the `khunt` toolkit and the SQLi entry point.
## Attack Methodology
- **Initial Access:** SQL Injection via a vulnerable public-facing Java/Tomcat application.
- **Persistence:** Creation of stored schema objects within the Oracle database using Java Source code.
- **Privilege Escalation:** Running commands as the service account under which Oracle was running (often high-privilege/LocalSystem).
- **Defense Evasion:** Storing malicious toolkit components (`khuntCmd`, `khuntHash`) directly inside the database engine to avoid file-based antivirus detection.
- **Credential Access:** Attempted theft of Windows registry hives (`SAM`, `SECURITY`, `SYSTEM`) using `reg.exe`.
- **Discovery:** Utilization of the `khunt` toolkit to explore the host environment.
- **Lateral Movement:** N/A (Focused on host-level escalation).
- **Collection:** Aggregating usernames and passwords into local files for exfiltration.
- **Exfiltration:** Attempted extraction of registry hives.
- **Impact:** Full OS-level Remote Code Execution (RCE) on the database server.
## Impact Assessment
- **Financial:** Not disclosed (Costs related to incident response and remediation).
- **Data Breach:** Attempted theft of local administrative and service account credentials.
- **Operational:** Potential for full system takeover and disruption of database services.
- **Reputational:** Risk associated with the exploitation of a "classic" preventable vulnerability.
## Indicators of Compromise
- **File indicators:**
- `khuntCmd` (Oracle Schema Object)
- `khuntHash` (Oracle Schema Object)
- **Behavioral indicators:**
- `oracle.exe` spawning `reg.exe`
- `oracle.exe` spawning `cmd.exe` or `powershell.exe`
- Large volumes of `CREATE JAVA SOURCE` commands in database logs.
## Response Actions
- **Containment:** Isolated the affected database server and blocked the malicious IP addresses.
- **Eradication:** Deleted the malicious Java Source objects from the Oracle database; patched the vulnerable web application to sanitize SQL inputs.
- **Recovery:** Restored service after ensuring all "khunt" toolkit components were removed and credentials were rotated.
## Lessons Learned
- **Input Validation is Critical:** Classic vulnerabilities like SQLi remain highly effective if basic security coding practices are ignored.
- **Database Hardening:** Features like Oracle's embedded JVM, if not required for business operations, represent a significant attack surface that can be abused for RCE.
- **Process Monitoring:** Monitoring parent-child process relationships (e.g., a database engine spawning a shell) is a highly effective detection method.
## Recommendations
- **Web Application Firewall (WAF):** Deploy a WAF to detect and block SQL injection patterns.
- **Secure Coding:** Implement parameterized queries (Prepared Statements) in all application code.
- **Principle of Least Privilege:** Run database services under low-privileged accounts and restrict the ability to run `CREATE JAVA SOURCE` or interact with the OS.
- **Regular Auditing:** Periodically audit Oracle database schema objects for unauthorized Java Source or stored procedures.