Huntress discovered an attack where hackers exploited a SQL injection vulnerability in a public-facing Java/Apache Tomcat application to install a post-exploitation toolkit called 'khunt' directly inside an Oracle database. The toolkit leveraged Oracle's embedded JVM and CREATE JAVA SOURCE functionality to store and execute Java components as database schema objects, enabling OS-level command execution with SYSTEM privileges, credential theft via Oracle's internal user table, and file system access. Components included KhuntCmd, KhuntHash, KhuntFS, KhuntT, and KhuntUnzip. Attackers used these to dump Windows SAM/SECURITY/SYSTEM registry hives for offline credential recovery. Huntress notes this technique of embedding malicious Java inside Oracle databases has rarely been documented in the wild. Recommended mitigations include input sanitization and restricting database account privileges.
