Hackers Used an Oracle Database to Run the khunt Post-Exploitation Toolkit
Summary
Huntress reports that attackers used SQL injection in a public-facing Java application to install khunt in an Oracle database and run commands with SYSTEM privileges. Registry-hive theft was suspected, but successful exfiltration was not confirmed.
Key points
- Huntress detected the intrusion on July 27, 2026, after its platform identified credential theft on a server hosting Oracle.
- Apache access logs showed SQL injection through a vulnerable search endpoint in a public-facing Java application running Apache Tomcat.
- Attackers stored and compiled khunt as a Java object in Oracle, then used SQL commands to execute it.
- The toolkit included components for command execution, credential access, file operations, and extracting compressed files.
- A whoami command run through Oracle returned SYSTEM-level access on the Windows server.
- Attackers copied the SAM, SECURITY, and SYSTEM registry hives; Huntress said they were likely exfiltrated for credential dumping, but did not confirm successful theft.
- Huntress recommends validating user input and limiting database-account permissions, including restricting unnecessary Java-source creation and stored-procedure execution.
Article Details
- Attack Vectors
- Attackers exploited SQL injection in an autocomplete search endpoint of a public-facing Java application running Apache Tomcat.
- The attackers compiled and stored the khunt toolkit as a Java object in the Oracle database, then used SQL commands to execute it.
- The attackers used the toolkit to run Windows commands, including cmd.exe /c whoami, and used PowerShell and Windows utilities to copy registry hives.
- Defensive Notes
- Sanitize and validate user-supplied input.
- Limit database account privileges for public-facing applications; avoid granting permissions to create Java sources, execute unnecessary stored procedures, or perform other administrative actions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 178[.]162[.]151[.]229 | Huntress traced the malicious requests in the intrusion to this IP address. |
MITRE ATT&CK
T1003.002 · Security Account ManagerThe attackers copied the SAM, SECURITY, and SYSTEM registry hives, which Huntress said were likely taken for credential dumping; successful theft was not confirmed.T1007 · System Service DiscoveryThe attackers ran tasklist /svc to enumerate running services and saved the output to khunttasks.txt.T1033 · System Owner/User DiscoveryThe attackers ran cmd.exe /c whoami to identify the execution context, which had SYSTEM-level privileges on the Windows server.T1059.001 · PowerShellThe attackers used PowerShell while copying the SAM, SECURITY, and SYSTEM registry hives.T1059.003 · Windows Command ShellKhuntCmd launched cmd.exe; the attackers ran cmd.exe /c whoami through the Oracle database.T1190 · Exploit Public-Facing ApplicationThe attackers exploited SQL injection in a vulnerable search endpoint of a public-facing Java application.
Vendors
Products
Apache TomcatApache access logs showed that the attackers gained access through a vulnerable search engine endpoint in a public-facing Java application running Apache Tomcat.Microsoft WindowsHackers used a SQL injection flaw in a public-facing Java application to implant the khunt toolkit directly inside an Oracle database and then execute commands on a Windows server with SYSTEM privileges.OracleHackers used a SQL injection flaw in a public-facing Java application to implant the khunt toolkit directly inside an Oracle database and then execute commands on a Windows server with SYSTEM privileges.