Attackers hide hacking toolkit inside Oracle databases
Attackers broke into a public web application through a basic SQL injection flaw, then used that access to build a hacking toolkit directly inside the Oracle database behind it. From there they took full SYSTEM-level control of the Windows server and copied its password files.
- Report priority
- Medium
- Involves
- Oracle Database
What is known
A search box on a public Java web app passed whatever text a visitor typed straight to the Oracle database without checking it, so the attacker typed database commands instead of a search term and the app ran them.
What to do
Check whether any public-facing app your organization runs sends user-typed input, such as search or autocomplete text, straight into SQL queries without validation, and search your Oracle database for object names starting with KHUNT as a sign of this exact toolkit.
There is no Oracle software patch for this, since it exploited unsafe application code rather than a bug in Oracle Database, so fix it by parameterizing all queries, sanitizing input on the vulnerable form, and restricting database accounts so they cannot create Java objects or run system commands even if injected again.
Reported details
A public Java web application built on Apache Tomcat connects to an Oracle database. An attacker submits SQL commands into the app's autocomplete search box, and the app passes that input straight to the database instead of treating it as plain text. The attacker uses that opening to build a hacking toolkit inside the database itself, then runs a Windows command through it and confirms the database process has SYSTEM-level control of the server. They copy the server's password-hash files and list its running services, saving the results to text files on the drive.
The attacker abused Oracle's embedded Java Virtual Machine, sending CREATE JAVA SOURCE statements over a JDBC connection from a vulnerable Tomcat application to compile a toolkit named khunt as a database schema object. Components included KhuntCmd (runs OS commands via cmd.exe), KhuntHash (dumps Oracle's internal username and password table), KhuntFS/KhuntFS2 (file browsing), KhuntT (connectivity check), and KhuntUnzip, wrapped in PL/SQL. The attacker confirmed SYSTEM-level code execution with whoami, then used PowerShell, reg.exe, and esentutl.exe to copy the SAM, SECURITY, and SYSTEM registry hives for offline credential extraction, and ran tasklist /svc to enumerate services.