Oracle Database Exploited via Advanced SQL Injection Attack Using ‘khunt’ Toolkit

Post Views: 3

Oracle database compromised through SQL injection, with khunt toolkit deployed for post-exploitation activities.

Initial Compromise

Cybersecurity analysts identified a complex cyber intrusion exploiting a SQL Injection flaw in an Oracle database environment. Attackers deployed the khunt toolkit, enabling execution of system commands, data access, and credential extraction without traditional malware.

Vulnerable Search Endpoint

The breach was detected on July 27, 2026, following anomalous credential harvesting. The initial compromise occurred via a vulnerable search endpoint in a publicly accessible Java-based web application hosted on Apache Tomcat. The autocomplete functionality lacked proper input validation, allowing SQL command injection.

Database Exploitation

Attackers leveraged Oracle’s embedded Java Virtual Machine (JVM) and CREATE JAVA SOURCE feature to embed the khunt toolkit as Java objects within the database schema. This enabled execution of Java code through SQL commands, with potential to invoke OS-level processes when privileges permitted.

khunt Toolkit Components

The khunt framework included Java components and PL/SQL modules for post-compromise operations. Key functionalities included:

KhuntCmd: System command execution
KhuntHash: Credential extraction from Oracle tables
KhuntFS and KhuntFS2: File system interactions
KhuntT: Verification
KhuntUnzip: Archive decompression

Attack Execution

Attackers executed cmd.exe /c whoami via KhuntCmd, demonstrating SYSTEM-level privileges on a Windows server. Subsequent actions involved PowerShell and native utilities to extract SAM, SECURITY, and SYSTEM registry hives, which store password hashes. Tasklist /svc was used to identify running services, with results stored in text files.

Security Implications

While registry hives were likely intended for credential extraction, no evidence of data exfiltration was confirmed. A security researcher from Algoritha Security emphasized that unpatched SQL Injection vulnerabilities remain critical threats when input validation is neglected.

Expert Recommendations

The expert highlighted the importance of input sanitization, least privilege principles, and restricting database account permissions. Cybersecurity professionals recommended enhanced monitoring of database activities and regular security audits to mitigate risks.

“Unpatched SQL Injection vulnerabilities remain critical threats when proper input validation is neglected,” said a security researcher from Algoritha Security.

Conclusion

This attack underscores the risks of unpatched vulnerabilities and the need for robust input validation. The deployment of the khunt toolkit within the database highlights the evolving tactics of cyber adversaries, requiring proactive security measures and continuous monitoring.