--- title: "Hackers run khunt post-exploitation toolkit from Oracle database" url: https://daily.dev/posts/hackers-run-khunt-post-exploitation-toolkit-from-oracle-database-2ouplttjp source_url: https://www.bleepingcomputer.com/news/security/hackers-run-khunt-post-exploitation-toolkit-from-oracle-database type: article source: "BleepingComputer" published: 2026-08-05T20:00:10.775Z updated: 2026-08-06T12:51:19.290Z tags: ["java", "sql", "oracle"] reading_time: 3 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers run khunt post-exploitation toolkit from Oracle database **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Huntress discovered an attack where hackers exploited a SQL injection vulnerability in a public-facing Java/Apache Tomcat application to install a post-exploitation toolkit called 'khunt' directly inside an Oracle database. The toolkit leveraged Oracle's embedded JVM and CREATE JAVA SOURCE functionality to store and execute Java components as database schema objects, enabling OS-level command execution with SYSTEM privileges, credential theft via Oracle's internal user table, and file system access. Components included KhuntCmd, KhuntHash, KhuntFS, KhuntT, and KhuntUnzip. Attackers used these to dump Windows SAM/SECURITY/SYSTEM registry hives for offline credential recovery. Huntress notes this technique of embedding malicious Java inside Oracle databases has rarely been documented in the wild. Recommended mitigations include input sanitization and restricting database account privileges. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#java](https://daily.dev/tags/java), [#sql](https://daily.dev/tags/sql), [#oracle](https://daily.dev/tags/oracle) [View this post on daily.dev](https://daily.dev/posts/hackers-run-khunt-post-exploitation-toolkit-from-oracle-database-2ouplttjp)