Hackers run khunt post-exploitation toolkit from Oracle database
Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. The attack was discovered by Huntress on July 27, 2026, after its security platform detected credential t…
Intelligence analysis by Llama
Hackers used a SQL injection vulnerability to install a post-exploitation toolkit called khunt directly into an Oracle database. The toolkit contained multiple Java components and PL/SQL wrappers that could execute commands, steal credentials, and manage files.
Imagine a hacker finding a way to sneak a special tool into a database that helps them control the computer. This tool, called khunt, lets the hacker do things like steal passwords, look at files, and even run commands on the computer. It's like a superpower for hackers, and it's very bad news for anyone who wants to keep their computer safe.
Analysis
A New Type of Attack Vector
The use of a post-exploitation toolkit like khunt to breach a corporate network is a new type of attack vector that highlights the risks of SQL injection vulnerabilities. By exploiting a vulnerability in a public-facing Java application, hackers were able to gain access to an Oracle database and install the toolkit directly into the database.
The Power of Java in Oracle
Oracle has an embedded Java Virtual Machine and the CREATE JAVA SOURCE statement, which allows Java source code to be stored and compiled as a database schema object. These Java objects can then be executed via SQL commands, which if configured to do so, can execute commands on the host operating system. The attackers abused this functionality to compile and store the khunt toolkit directly inside the Oracle database rather than deploying them as executable files on the server.
The Toolkit's Capabilities
The toolkit contained multiple Java components and PL/SQL wrappers that could execute commands, steal credentials, and manage files. These components included KhuntCmd, which launched cmd.exe and allowed attackers to execute operating system commands through SQL statements; KhuntHash, which accessed Oracle's internal user table and wrote usernames and password data to a file; KhuntFS and KhuntFS2, which provided file browsing, reading, searching, and file-size checking capabilities; KhuntT, which acted as a ping-like test to confirm that the toolkit had been successfully installed; and KhuntUnzip, which extracted compressed files.
Key points
- Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit called khunt directly into an Oracle database.
- The toolkit contained multiple Java components and PL/SQL wrappers that could execute commands, steal credentials, and manage files.
- The attackers used the toolkit to steal credentials, manage files, and execute commands on the host operating system.
If this development plays out positively, it could lead to increased awareness and vigilance among security teams, who may be more likely to detect and prevent similar attacks in the future.
The realistic downside risks or failure modes of this development include the potential for hackers to continue exploiting SQL injection vulnerabilities and installing post-exploitation toolkits, leading to further breaches and data theft.
