A SQL injection hole in a public web app gave intruders a way into an organization’s Oracle database, and from there they planted a post-exploitation toolkit that never touched disk, according to Huntress researchers.
The toolkit, tracked as khunt, was stored as database objects using Oracle’s CREATE JAVA SOURCE functionality. Oracle Database ships an embedded Java Virtual Machine for legitimate business applications, and the attackers abused it to upload, compile and run malicious Java code from inside the database engine.
Once compiled, the code executed operating system commands on the underlying host through SQL statements, letting the attackers blend into legitimate database activity while keeping a persistent foothold. Huntress said the chain ended in SYSTEM-level code execution on the compromised Windows server, and that the intrusion surfaced in July when credential theft detections fired.
Initial access came from an autocomplete search field that passed unvalidated input to the database over a JDBC connection. The account behind that connection had enough privilege to create Java objects, and no Oracle patch closes either the application flaw or that privilege gap.
That stealth is the point. Because the payload lives as compiled schema objects, it shows up in neither process lists nor filesystem scans, and endpoint tools rarely look inside Oracle. Huntress warns the database, once merely a target for queries, is now serving as the attackers’ staging ground.
