Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers breached an organization’s Oracle database via a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit named khunt without writing an executable to disk. By feeding Java source code to the database, they let Oracle compile it into stored schema objects and ran commands from inside the database engine. Huntress investigated after credential-theft detections on July 27, 2026, and traced the chain to SYSTEM-level code execution on the underlying Windows server.

The vulnerability was in the application’s autocomplete search field, which passed unvalidated input to the database over a JDBC connection. The account had sufficient privileges to create Java objects. No Oracle patch addresses the application flaw or the account privilege issue. The toolkit consisted of six Java objects and several khunt_* PL/SQL wrappers, including KhuntCmd (command execution), KhuntHash (reads password hashes), KhuntFS and KhuntFS2 (file operations), KhuntT (reachability check), and KhuntUnzip (archive extraction). The attackers used cmd.exe /c whoami to confirm SYSTEM access, then copied registry hives and used esentutl.exe to extract SAM and SECURITY hives.

Huntress noted the technique is at least two decades old, referencing Marco Ivaldi’s raptor_oraexec.sql from 2006. The malicious requests traced to 178.162.151[.]229, but no threat actor was named. The fix involves parameterized queries, input validation, and least privilege for database accounts.