Huntress has documented an attack where threat actors exploited a SQL injection vulnerability in a public-facing application to gain access to an Oracle Database, then leveraged Oracle's embedded Java Virtual Machine (OJVM) to upload, compile, and execute a custom post-exploitation toolkit called Khunt directly inside the database. This allowed attackers to blend into legitimate database functionality, achieve persistence, and ultimately escalate to SYSTEM-level access on the underlying Windows server — including dumping Windows SAM, SECURITY, and SYSTEM registry hives for offline password hash extraction. Huntress recommends auditing Oracle environments for unexpected Java source objects and compiled classes, ensuring forms are not injectable, and avoiding overprivileged database users.
