Attackers use SQL injection to compile and run 'khunt' toolkit within Oracle databases for SYSTEM access

SQL Injection Leads to Database Compromise

Attackers breached an organization's Oracle database by exploiting a SQL injection vulnerability found in an autocomplete search field of a public-facing web application. This flaw allowed unvalidated input to be passed to the database via a Java Database Connectivity (JDBC) connection. The compromised account used for this connection possessed sufficient privileges to create Java objects within the database.

In-Database Toolkit Compilation and Execution

Instead of deploying traditional executables, the attackers fed Java source code directly to the Oracle database. The database's embedded Java Virtual Machine compiled this code into stored schema objects, forming a post-exploitation toolkit tracked as 'khunt' by Huntress. This method allowed attackers to run commands from within the database engine itself, ultimately achieving SYSTEM-level code execution on the underlying Windows server.

Bypassing Traditional Security Measures

The 'khunt' toolkit, consisting of Java objects and PL/SQL wrappers, is not a process, binary, or file on the filesystem in the conventional sense. This characteristic enables it to bypass most endpoint detection and response (EDR) products, which typically do not inspect Oracle's internal components. Huntress noted that this transforms the database from a query target into an attack launchpad.

Historical Technique Resurfaces

This technique of compiling and executing code within Oracle databases is not new, with similar methods documented as far back as 2006. The 'khunt' objects utilize the same basic architecture as older tools like Marco Ivaldi's raptor_oraexec.sql. Despite its age, the use of this specific technique in real-world attacks has been rarely documented until now.

Toolkit Components and Detection

The 'khunt' toolkit included six Java objects and several PL/SQL wrappers. For example, 'KhuntCmd' allowed arbitrary operating-system commands to be run by loading cmd.exe and passing commands as SQL. Detection involves searching Oracle installations for object names beginning with 'Khunt' and SQL logs for 'KHUNT%'. The underlying application flaw and the account's excessive privileges remain unpatched by Oracle.