Cyberattackers have been caught exploiting a vulnerability in an Oracle database to install a post-exploitation toolkit, giving them unfettered access to a corporate network. The attack was discovered by security firm Huntress on July 27, after its platform detected suspicious activity involving credential theft on a server hosting the Oracle database.
The attackers exploited a SQL injection flaw in a public-facing Java application running Apache Tomcat, which allowed them to issue malicious SQL commands directly to the Oracle database. This vulnerability was introduced through an autocomplete search feature that failed to properly validate user input. As a result, hackers were able to gain access to the network and install a toolkit called khunt directly into the Oracle database.
The use of this technique is rare in real-world attacks, according to Huntress. The attackers took advantage of Oracle’s embedded Java Virtual Machine and CREATE JAVA SOURCE statement, which allows Java source code to be stored and compiled as a database schema object. This functionality can execute commands on the host operating system if configured to do so.
The khunt toolkit contained multiple Java components and PL/SQL wrappers that allowed the attackers to execute commands, steal credentials, and manage files. These components included tools for launching operating system commands through SQL statements, accessing user tables to write usernames and password data to a file, providing file browsing capabilities, and confirming installation of the toolkit.
The attackers used these tools to run various commands, including whoami to confirm they had SYSTEM-level permissions on the Windows server. They then used PowerShell and Windows utilities to copy registry hives that can be used to recover password hashes for local Windows accounts. The registry hives were likely exfiltrated for credential dumping, although it’s unclear whether the files were successfully stolen.
This attack highlights the importance of proper input validation and limiting privileges granted to application database accounts. Huntress recommends that organizations should not grant high enough privileges to database accounts used in public-facing applications to create Java sources or perform administrative actions.
As security teams struggle to keep up with the pace of attacks, it’s essential for organizations to test every layer of their defenses before attackers do. By regularly simulating breach and attack scenarios, companies can ensure that their SIEM and EDR rules are effective and reduce the likelihood of undetected threats slipping through the net.
In light of this attack, organizations should prioritize input validation in all user-supplied data, limit privileges granted to application database accounts, and conduct regular breach and attack simulation tests.
Source: Bleeping Computer — 2026-08-05