Oracle Database targeted by novel khunt toolkit via SQL injection

Security researchers have identified a novel attack chain targeting Oracle Databases using a post-exploitation toolkit named "khunt." The attack begins with a SQL injection vulnerability in public-facing web applications that use JDBC connections with elevated privileges.

Instead of deploying traditional malware that leaves traces on a physical disk, attackers feed Java source code directly into Oracle's built-in Java compiler. This creates malicious stored schema objects within the database itself. Because the toolkit resides as database objects rather than executable files, it can bypass many traditional antivirus and Endpoint Detection and Response (EDR) tools that monitor file-based indicators of compromise.

The toolkit includes several modules: - KhuntCmd: Executes OS-level commands via cmd.exe. - KhuntHash: Reads internal user tables to export account information and password hashes. - KhuntT: Verifies the toolkit's installation and functionality. - KhuntUnzip: Facilitates file decompression.

By utilizing these modules, attackers can achieve SYSTEM-level privileges on the underlying Windows server and manipulate the Windows registry to crack local user accounts. Security experts recommend auditing JDBC connection accounts for unnecessary CREATE JAVA privileges, implementing strict input sanitization, and using query parameterization to prevent SQL injection.