Threat actors exploited a SQL injection vulnerability in a public-facing web application to compromise an Oracle database, then deployed a sophisticated post-exploitation toolkit called khunt to escalate privileges to Windows SYSTEM level.
The attack chain bypassed traditional endpoint detection by avoiding executable writes to disk. Instead, attackers injected Java source code directly into Oracle, allowing the database engine itself to compile the code into stored schema objects. Commands executed from within the database process, giving attackers a foothold inside the victim's infrastructure while evading file-based security monitoring.
Huntress researchers identified and tracked the khunt toolkit, which transforms the initial SQL injection access into deep system compromise. This technique exploits a fundamental trust relationship: most organizations monitor disk activity and network connections but dedicate fewer resources to detecting malicious activity originating from trusted database processes.
The vulnerability represents a chained attack scenario rather than a single flaw. The initial SQL injection exists in the web application layer. The second vulnerability lies in Oracle database permissions that allow untrusted users to create and execute Java objects within the database engine. Together, they form a pathway from external attacker to internal system administrator privileges.
Organizations running Oracle databases face particular risk if they expose web applications to untrusted input without proper query parameterization or input validation. Database-hosted Java compilation features, while useful for legitimate development, become dangerous when database access controls fail.
The attack demonstrates why SQL injection remains critical decades after discovery. Even modern security stacks often miss it because detection focuses on network-layer indicators and executable file creation. An attacker running malicious code inside a database process generates minimal traditional security telemetry.
Defensive measures include applying the latest Oracle security patches, enforcing strong SQL query parameterization in all web applications, restricting database user permissions to minimum required levels, and monitoring for unexpected Java object creation or code compilation within database systems. Organizations should audit which database users hold Java