Ethical Hacking News
Attackers Compiles khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access, highlighting the need for regular vulnerability assessments and patching of software.
A vulnerability in an Oracle database was discovered that allowed attackers to gain system-level access using a post-exploitation toolkit called "khunt". The vulnerability was exploited through an SQL injection flaw in a public-facing web application, allowing attackers to compile and execute malicious code. The khunt toolkit utilizes Oracle's embedded Java Virtual Machine (JVM) to compile and execute malicious code, and its tools perform specific functions such as loading command.exe and searching for files. Exploiting this vulnerability requires sufficient privileges in the Oracle database, but there are no known Oracle patches that address either the application flaw or the account privilege behind it. The use of the khunt toolkit is not a new technique, with Marco Ivaldi's raptor_oraexec.sql dating back to 2006 demonstrating its existence for at least two decades. Regular vulnerability assessments and patching of software are crucial in preventing such attacks.
The world of cybersecurity is constantly evolving, and new techniques are being discovered all the time. In recent days, a vulnerability in an Oracle database was discovered that allowed attackers to gain system-level access using a post-exploitation toolkit known as "khunt". This toolkit utilizes Oracle's embedded Java Virtual Machine (JVM) to compile and execute malicious code.
The vulnerability in question was discovered through an SQL injection flaw in a public-facing web application. The attacker exploited this flaw by feeding Java source code to the database, allowing the Oracle JVM to compile it into stored schema objects. These objects were then executed using the "khunt" toolkit, which allowed the attackers to run commands on the underlying Windows server.
The khunt toolkit is comprised of several different tools, including KhuntCmd, KhuntHash, KhuntFS, and KhuntT. Each tool performs a specific function, such as loading command.exe, reading usernames and password hashes, or searching for files. The attackers used these tools to copy registry hives into F:\Oracle, run tasklist /svc commands, and access the SYSTEM registry hive.
In order to exploit this vulnerability, an attacker would need to have sufficient privileges in the Oracle database, allowing them to create Java objects. This is where the problem lies, as there are no known Oracle patches that address either the application flaw or the account privilege behind it. The only way to find the toolkit is to search for object names beginning with "khunt" and SQL logs containing the string "%KHUNT%".
Furthermore, the use of the khunt toolkit is not a new technique. Marco Ivaldi's raptor_oraexec.sql dating back to 2006 demonstrates that this method has been around for at least two decades. This highlights the importance of regular vulnerability assessments and patching of software.
The findings were reported by Huntress, a firm that tracks the khunt toolkit. They observed the files being staged locally but did not establish whether they had been exfiltrated. The attackers were traced to an IP address of 178.162.151[.]229. However, no threat actor was identified and the attack indicators are specific to this toolkit, meaning that searching for "khunt" or "%KHUNT%" will not surface this technique.
In conclusion, the discovery of the khunt toolkit is a reminder of the ongoing cat-and-mouse game between attackers and defenders in the cybersecurity world. The use of Oracle's embedded Java Virtual Machine as a post-exploitation tool shows just how creative and persistent attackers can be.
Attackers Compiles khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-Oracles-Embedded-Java-Virtual-Machine-A-Post-Exploitation-Toolkit-Allows-for-System-Level-Access-ehn.shtml
https://thehackernews.com/2026/08/attackers-compile-khunt-inside-oracle.html
https://www.imtr.net/article/attackers-compile-khunt-inside-oracle-to-turn-sql-injection-into-windows-system-d2c3
Published: Thu Aug 6 05:21:38 2026 by llama3.2 3B Q4_K_M
