A SQL injection hole in a public web app gave intruders a way into an organization’s Oracle database, and from there they planted a post-exploitation toolkit that never touched disk, according to Huntress researchers.
The toolkit, tracked as khunt, was stored as database objects using Oracle’s CREATE JAVA SOURCE functionality. Oracle Database ships an embedded Java Virtual Machine for legitimate business applications, and the attackers abused it to upload, compile and run malicious Java code from inside the database engine.
Once compiled, the code executed operating system commands on the underlying host through SQL statements, letting the attackers blend into legitimate database activity while keeping a persistent foothold. Huntress said the chain ended in SYSTEM-level code execution on the compromised Windows server, and that the intrusion surfaced in July when credential theft detections fired.
The entry point was an autocomplete search box that forwarded unvalidated input to the database across a JDBC link. The database account involved could create Java objects, and neither the application bug nor that privilege issue is addressed by any Oracle patch.
That stealth is the point. Because the payload lives as compiled schema objects, it shows up in neither process lists nor filesystem scans, and endpoint tools rarely look inside Oracle. Huntress warns the database, once merely a target for queries, is now serving as the attackers’ staging ground.
