Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Attackers used SQL injection to compile Java code within Oracle, gaining SYSTEM access on Windows.
Attackers exploited a SQL injection vulnerability in a web application to gain access to an Oracle database. They then compiled Java code directly within the database, turning it into a platform to execute commands on the underlying Windows server with SYSTEM privileges, without writing any executables to disk. The toolkit, tracked as 'khunt' by Huntress, included modules for command execution, file access, and credential theft.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Oracle?
Get an email when a new story names Oracle, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited an unpatched SQL injection vulnerability to pivot directly into an Oracle database, then abused a legitimate but dangerous Oracle feature — the ability to compile and execute Java stored procedures — to escalate privileges all the way to Windows SYSTEM without ever touching disk. This fileless attack chain demonstrates how a single unmitigated web application vulnerability can cascade into full operating system compromise. The misconfiguration of Oracle's Java execution capabilities provided the critical bridge between database access and OS-level control. Organizations that do not harden database server configurations independently of their application security posture leave an extremely powerful lateral movement path wide open.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 178.162.151.229
- malware — khunt