On July 27, 2026, **Huntress** security researchers detected suspicious credential theft activity on a server hosting an **Oracle** database. Further investigation revealed a highly unusual attack chain that leveraged a SQL injection vulnerability to deploy a persistent post-exploitation toolkit. Attackers gained initial access through a vulnerable search engine endpoint within a public-facing Java application running **Apache Tomcat**. The application's autocomplete search feature failed to properly validate user input, allowing malicious SQL commands to be injected directly into the **Oracle** database. The malicious requests were traced to the IP address `178.162.151[.]229`. ## khunt Toolkit Stored Inside Oracle What makes this attack particularly noteworthy is the method of toolkit deployment. Instead of dropping executable files onto the server, the attackers installed the **khunt** post-exploitation toolkit directly into the **Oracle** database as a Java object. **Oracle** databases feature an embedded Java Virtual Machine and the `CREATE JAVA SOURCE` statement, enabling Java source code to be stored and compiled as a database schema object. These Java objects, if configured with sufficient privileges, can then be executed via SQL commands to run operating system commands on the host. This functionality was abused to compile and store the **khunt** toolkit within the database itself. **Huntress** noted that this technique has been rarely documented in the wild. ## Components of the khunt Toolkit The **khunt** toolkit comprised several Java components and PL/SQL wrappers designed for various malicious activities, including command execution, credential theft, and file management. Key components identified include: * **KhuntCmd**: Used to launch `cmd.exe`, enabling attackers to execute operating system commands via SQL statements. * **KhuntHash**: Accessed **Oracle**'s internal user table to extract usernames and password data, writing them to a file. * **KhuntFS** and **KhuntFS2**: Provided file browsing, reading, searching, and file-size checking capabilities. * **KhuntT**: A diagnostic tool, similar to a ping, to confirm successful toolkit installation. * **KhuntUnzip**: For extracting compressed files. Using **KhuntCmd**, the attackers executed `cmd.exe /c whoami`, confirming that commands run through the **Oracle** database had **SYSTEM**-level permissions on the Windows server. They then leveraged PowerShell and Windows utilities to copy the SAM, SECURITY, and SYSTEM registry hives, which are crucial for recovering password hashes for local Windows accounts. Additionally, `tasklist /svc` was run to enumerate services, with the output saved to `khunttasks.txt`. While **Huntress** believes the registry hives were likely exfiltrated for credential dumping, the report does not definitively confirm the successful theft of these files. ## Mitigating Such Attacks This incident underscores the critical importance of robust security practices. Organizations must prioritize comprehensive input validation for all user-supplied data to prevent SQL injection vulnerabilities. Furthermore, it is essential to adhere to the principle of least privilege, especially for database accounts used by public-facing applications. **Huntress** strongly recommends that database accounts associated with public applications should not possess high-level privileges that allow for Java source creation, execution of unnecessary stored procedures, or other administrative actions. Limiting these privileges can significantly reduce the attack surface and mitigate the impact of successful database compromises.