Medium cybersecurity update: Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine. Huntress, which tracks the toolkit as khunt, Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Swati Khandelwal Aug 06, 2026 Database Security / Endpoint Security Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. Huntress, which tracks the toolkit as khunt , investigated after credential-theft detections fired on July 27, 2026, and traced the chain to SYSTEM-level code execution on the underlying Windows server. The flaw sat in the application, where an autocomplete search field passed unvalidated input to the database over a Java Database Connectivity (JDBC) connection. The account behind that connection had enough privilege to create Java objects. No Oracle patch closes either the application flaw or the account privilege behind it.
Technical Details
Finding the toolkit means hunting: search the Oracle installation for object names beginning Khunt, and SQL logs for KHUNT%. A Java class compiled into a database schema object is not a process, a binary, or a file on the filesystem, and endpoint detection and response products do not generally inspect Oracle's internals. As Huntress frames it, the database stops being something attackers query and becomes a beachhead they attack from. Oracle ships an embedded Java Virtual Machine, and the CREATE JAVA SOURCE statement lets a user hand it Java code that the database compiles and stores as a schema object. In a user's own schema, Oracle's documentation puts the bar at a single system privilege, CREATE PROCEDURE. Spawning an operating-system process from that code runs through Runtime.exec , which needs its own file-execution permission, and Oracle says those are issued only by privileged administrators . Huntress does not say which grants the compromised account held, or whether the attackers had to add any. Marco Ivaldi's raptor_oraexec.sql , dated 2006, creates an Oracle source object with command-execution and file-read methods, then publishes them to SQL through PL/SQL wrappers. The khunt objects use the same basic architecture.
Security Impact
Organizations using the affected technology should treat the report according to its medium severity classification. "The use of the technique in the wild has rarely been documented," Huntress said . Six Java objects and several khunt_* PL/SQL wrappers made up the toolkit: KhuntCmd loaded cmd.exe and ran arbitrary operating-system commands passed in as SQL. KhuntHash read usernames and password hashes from Oracle's internal user table and wrote them to a file. Running cmd.exe /c whoami through KhuntCmd returned SYSTEM. The attackers then used PowerShell and reg.exe to copy the SECURITY and SYSTEM registry hives into F:\Oracle, ran tasklist /svc into khunttasks.txt, and copied the SAM and SECURITY hives with esentutl.exe. Huntress observed the files being staged locally, but did not establish that they were exfiltrated. The firm named no threat actor and traced the malicious requests to 178.162.151[.]229.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Medium
- Original source: The Hacker News
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from The Hacker News for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
