SQL Injection Enabled Oracle-Resident Toolkit and Windows Credential Theft
Summary
Huntress traced an attack on a public-facing Tomcat application to SQL injection, which let attackers install the khunt toolkit in Oracle, reach Windows SYSTEM-level execution, and copy registry hives containing credential hashes.
Key points
- Huntress observed the incident on July 27, 2026, after credential-theft detections on a Windows endpoint hosting an Oracle database.
- Attackers exploited an input-handling flaw in a public-facing Java/Tomcat application connected to Oracle over JDBC.
- They installed khunt by compiling Java source code inside Oracle; its modules enabled command execution, database credential access, and file operations.
- The toolkit let the attackers execute commands as SYSTEM on the underlying Windows host.
- Attackers copied SAM, SECURITY, and SYSTEM registry hives, which can expose local account password hashes.
- Defenses include input validation and query parameterization, limiting database privileges, and searching Oracle objects and SQL logs for khunt indicators.
Article Details
- Attack Vectors
- SQL injection against an inadequately validated endpoint in a public-facing Java/Tomcat application connected to an Oracle database via JDBC.
- The attacker used CREATE JAVA SOURCE commands to store and compile the khunt post-exploitation toolkit as Java objects inside the Oracle database.
- The attacker used khuntCmd to execute operating-system commands from the database and ran commands to copy Windows registry hives and enumerate services.
- Defensive Notes
- Use input sanitization and query parameterization to prevent injectable forms.
- Apply least privilege to database accounts; accounts used by applications should not be able to author Java sources or execute stored procedures unless required.
- Inspect Oracle database objects, including Java classes and PL/SQL wrappers, because endpoint tools focused on operating-system processes, binaries, and files may not inspect them.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 178[.]162[.]151[.]229 | Attacker IP address traced from requests to the vulnerable application's injectable endpoint. |
MITRE ATT&CK
T1003.002 · Security Account ManagerThe attacker copied the SAM, SECURITY, and SYSTEM registry hives, which the article says can be used to extract and decode local account password hashes.T1057 · Process DiscoveryThe attacker ran tasklist /svc to enumerate running services.T1059.001 · PowerShellThe attacker ran PowerShell commands to invoke reg.exe and copy registry hives.T1059.003 · Windows Command ShellThe attacker used KhuntCmd to launch cmd.exe and execute whoami.T1190 · Exploit Public-Facing ApplicationThe attacker exploited SQL injection in a public-facing application to gain initial access.
People
Vendors
Products
Apache TomcatMicrosoft WindowsWhen the first credential-theft detections fired, we saw that the command came from a process (C:\Windows\System32\reg.exe) that was spawned from an oracle.exe parent process. OracleNotably, after gaining initial access the threat actor dropped a post-exploitation toolkit (khunt) via a Java Source within an Oracle database, which is a novel aspect of this attack.
Tools
cmd.exeKhuntCmd—A module that loads cmd.exe on the system and allows the attacker to run arbitrary OS commands by sending SQL statements to the database that include them.esentutl.exeFinally, the attacker copied the SAM and SECURITY registry hives using esentutl.exe—the Extensible Storage Engine utility—saving these to F:\Oracle\khuntSAM.hiv and F:\Oracle\khunt_SECURITY.hiv.khuntNotably, after gaining initial access the threat actor dropped a post-exploitation toolkit (khunt) via a Java Source within an Oracle database, which is a novel aspect of this attack.KhuntCmdThe toolkit included several objects, including khuntCmd and khuntHash, which essentially acted as purpose-built tools that were compiled and stored in the database, and enabled malicious functionalities like running OSKhuntFSKhuntFS and KhuntFS2—Two file explorers that allow all sorts of file functionality, such as listing, reading, searching, and checking file sizes.KhuntFS2KhuntFS and KhuntFS2—Two file explorers that allow all sorts of file functionality, such as listing, reading, searching, and checking file sizes.KhuntHashThe toolkit included several objects, including khuntCmd and khuntHash, which essentially acted as purpose-built tools that were compiled and stored in the database, and enabled malicious functionalities like running OSKhuntTKhuntT—A simple "ping" tool designed to confirm that the toolkit is installed, working, and reachable before proceeding with the attack.KhuntUnzipKhuntUnzip—A tool for unzipping files.PowerShellShortly thereafter, the attacker ran PowerShell commands to invoke the Window Registry tool (reg.exe) and make copies of the SECURITY and SYSTEM registry hives, saving them to F:\Oracle\khuntSECURITY.hiv andreg.exeWhen the first credential-theft detections fired, we saw that the command came from a process (C:\Windows\System32\reg.exe) that was spawned from an oracle.exe parent process. tasklistThe attacker then ran tasklist /svc in order to enumerate running services, saving them to a file alongside the registry hives as F:\Oracle\khunttasks.txt.