Inside the Khunt Attack: How Hackers Turned an Oracle Database Into a Post-Exploitation Platform
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle... The toolkit included components for command execution (KhuntCmd), hash extraction (KhuntHash), f...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle...
The toolkit included components for command execution (KhuntCmd), hash extraction (KhuntHash), file exploration (KhuntFS/FS2), and more, ultimately giving attackers SYSTEM level access to the underlying Windows server.
Huntress highlighted critical blind spots: EDR/AV tools do not inspect Oracle Java classes and PL/SQL wrappers, and overprovisioned database accounts made the attack possible.
What was the SQL injection attack discovered in July 2026 that used Oracle database objects to host the "khunt" post-exploitation toolkit, wAI-generated editorial hero image representing the July 2026 khunt SQL injection attack on an Oracle database
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What was the SQL injection attack discovered in July 2026 that used Oracle database objects to host the "khunt" post-exploitation toolkit, w. Article summary: Here is a complete breakdown of the attack, the toolkit, the privilege escalation path, and the defensive blind spots identified by Huntress.. Topic tags: general, documentation, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layo
openai.com
On July 27, 2026, Huntress was alerted to credential theft activity on an endpoint hosting an Oracle database server. The investigation revealed a sophisticated SQL injection attack—not exploiting a zero-day, but a well-known vulnerability class in a public-facing Java/Tomcat web application. What made this attack notable was the attackers' technique: instead of dropping files on disk, they used Oracle's built-in Java Virtual Machine to compile and store an entire post-exploitation toolkit called "khunt" as Java schema objects inside the database itself. This allowed the toolkit to evade traditional endpoint detection and response (EDR) and antivirus tools, which do not inspect database objects. From there, the attackers pivoted to the underlying Windows OS, achieving full SYSTEM-level remote code execution (RCE), extracting registry hives containing password hashes, and exfiltrating them offline. Huntress traced the attacker infrastructure to IP 178.162.151[.]229 .
How the Attack Worked: SQL Injection Through an Autocomplete Search
The initial access vector was a SQL injection vulnerability in a public-facing Java application running on Apache Tomcat . The application's autocomplete search feature failed to properly validate user input, allowing attackers to inject SQL commands through a JDBC connection to the Oracle database . As Huntress researchers noted, this was not a novel vulnerability class—SQL injection attacks have existed for decades and are typically the result of mishandling user inputs going to the SQL server . The application's failure to sanitize a simple search field was enough to begin the chain of compromise.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "Inside the Khunt Attack: How Hackers Turned an Oracle Database Into a Post-Exploitation Platform"?
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle...
What are the key points to validate first?
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle... The toolkit included components for command execution (KhuntCmd), hash extraction (KhuntHash), file exploration (KhuntFS/FS2), and more, ultimately giving attackers SYSTEM level access to the underlying Windows server.
What should I do next in practice?
Huntress highlighted critical blind spots: EDR/AV tools do not inspect Oracle Java classes and PL/SQL wrappers, and overprovisioned database accounts made the attack possible.
Inside the Khunt Attack: How Hackers Turned an Oracle Database Into a Post-Exploitation Platform
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle... The toolkit included components for command execution (KhuntCmd), hash extraction (KhuntHash), f...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle...
The toolkit included components for command execution (KhuntCmd), hash extraction (KhuntHash), file exploration (KhuntFS/FS2), and more, ultimately giving attackers SYSTEM level access to the underlying Windows server.
Huntress highlighted critical blind spots: EDR/AV tools do not inspect Oracle Java classes and PL/SQL wrappers, and overprovisioned database accounts made the attack possible.
What was the SQL injection attack discovered in July 2026 that used Oracle database objects to host the "khunt" post-exploitation toolkit, wAI-generated editorial hero image representing the July 2026 khunt SQL injection attack on an Oracle database
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What was the SQL injection attack discovered in July 2026 that used Oracle database objects to host the "khunt" post-exploitation toolkit, w. Article summary: Here is a complete breakdown of the attack, the toolkit, the privilege escalation path, and the defensive blind spots identified by Huntress.. Topic tags: general, documentation, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layo
openai.com
On July 27, 2026, Huntress was alerted to credential theft activity on an endpoint hosting an Oracle database server. The investigation revealed a sophisticated SQL injection attack—not exploiting a zero-day, but a well-known vulnerability class in a public-facing Java/Tomcat web application. What made this attack notable was the attackers' technique: instead of dropping files on disk, they used Oracle's built-in Java Virtual Machine to compile and store an entire post-exploitation toolkit called "khunt" as Java schema objects inside the database itself. This allowed the toolkit to evade traditional endpoint detection and response (EDR) and antivirus tools, which do not inspect database objects. From there, the attackers pivoted to the underlying Windows OS, achieving full SYSTEM-level remote code execution (RCE), extracting registry hives containing password hashes, and exfiltrating them offline. Huntress traced the attacker infrastructure to IP 178.162.151[.]229 .
How the Attack Worked: SQL Injection Through an Autocomplete Search
The initial access vector was a SQL injection vulnerability in a public-facing Java application running on Apache Tomcat . The application's autocomplete search feature failed to properly validate user input, allowing attackers to inject SQL commands through a JDBC connection to the Oracle database . As Huntress researchers noted, this was not a novel vulnerability class—SQL injection attacks have existed for decades and are typically the result of mishandling user inputs going to the SQL server . The application's failure to sanitize a simple search field was enough to begin the chain of compromise.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "Inside the Khunt Attack: How Hackers Turned an Oracle Database Into a Post-Exploitation Platform"?
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle...
What are the key points to validate first?
In July 2026, Huntress discovered a SQL injection attack where threat actors exploited a public facing Java/Tomcat web app to inject the entire 'khunt' post exploitation toolkit as Java schema objects inside an Oracle... The toolkit included components for command execution (KhuntCmd), hash extraction (KhuntHash), file exploration (KhuntFS/FS2), and more, ultimately giving attackers SYSTEM level access to the underlying Windows server.
What should I do next in practice?
Huntress highlighted critical blind spots: EDR/AV tools do not inspect Oracle Java classes and PL/SQL wrappers, and overprovisioned database accounts made the attack possible.
The Khunt Toolkit: Living Inside the Database as Java Objects
Instead of deploying traditional malware files on the compromised server, the attackers used Oracle's built-in Java Virtual Machine (JVM) and the CREATE JAVA SOURCE statement to compile and store the entire post-exploitation toolkit as Java schema objects inside the Oracle database . This approach made the toolkit invisible to standard OS-level defenses because EDR and antivirus tools focus on processes, binaries, and files on the operating system—they do not generally inspect Java classes and PL/SQL wrappers stored inside Oracle .
The khunt toolkit included these components, each stored as a database object:
Component
Function
KhuntCmd
Loads cmd.exe and executes arbitrary OS commands by embedding them in SQL statements sent to the database
KhuntHash
Extracts usernames and password hashes from Oracle's internal user tables and saves them to a file
KhuntFS / KhuntFS2
File explorers for listing, reading, searching, and checking file sizes on the compromised system
KhuntT
A simple "ping" tool to confirm the toolkit is installed and reachable before proceeding
KhuntUnzip
Utility for unzipping files
khunt_ PL/SQL wrappers*
PL/SQL wrapper procedures used to call the underlying Java methods
Achieving Full System Control: From Database to Windows OS
The attackers did not stop at database-level access. They used the khunt toolkit to pivot from the database layer to the underlying Windows operating system in a multi-step process:
OS command execution via KhuntCmd: They used the KhuntCmd module to run cmd.exe /c whoami, which confirmed they were running with SYSTEM-level privileges on the Windows server, establishing remote code execution (RCE) from the database to the OS .
Credential theft: They used PowerShell to invoke reg.exe and copy the SECURITY and SYSTEM registry hives, saving them as khuntSECURITY.hiv and khuntSYSTEM.hiv in F:\Oracle\.
Service enumeration: They ran tasklist /svc and saved the output as khunttasks.txt.
Additional hive extraction: They used esentutl.exe to copy the SAM and a second copy of the SECURITY hives, saving them as khuntSAM.hiv and khunt_SECURITY.hiv.
The exfiltrated registry hives could be used offline to extract and decode password hashes for all local accounts on the system .
Defense Blind Spots: Huntress's Key Findings
Huntress's investigation revealed several critical blind spots that allowed this attack to succeed and evade detection:
Database-as-beachhead shift: The database was transformed from a passive data store into an active attack platform, with the malicious toolkit living inside the database rather than on disk or in memory .
EDR/AV evasion: Traditional endpoint detection and response (EDR) and antivirus tools do not generally inspect Java classes and PL/SQL wrappers stored inside Oracle, making the toolkit invisible to standard OS-level defenses .
Classic vulnerability, novel delivery: The initial SQL injection was a well-known bug class. No zero-day was needed. The autocomplete search feature was enough to reach PL/SQL and then the OS, showing that basic input validation failures can lead to deep compromise when the database engine has OS-level capabilities .
Overprovisioned database accounts: Even after a SQL injection succeeds, the damage is limited if the database user account lacks privileges to author Java sources or execute stored procedures. Organizations often overprovision database accounts, giving attackers the extra permissions needed to deploy khunt .
Mitigations Recommended by Huntress
Based on this attack, Huntress recommended several mitigations :
Proper input sanitization and query parameterization for all web inputs
Restricting database user privileges so that even injected queries cannot create Java sources or execute arbitrary stored procedures
Expanding monitoring scope to include database objects (Java classes, PL/SQL wrappers) rather than only OS-level artifacts
This attack serves as a stark reminder that database engines with built-in programming environments (like Oracle's JVM) can become stealthy attack platforms when combined with even a single unvalidated input field. Security teams must extend their monitoring beyond the operating system to include the database object layer.
ibgids.nl
Hackers installeren khunt toolkit via SQL-injectie in Oracle ...
The Khunt Toolkit: Living Inside the Database as Java Objects
Instead of deploying traditional malware files on the compromised server, the attackers used Oracle's built-in Java Virtual Machine (JVM) and the CREATE JAVA SOURCE statement to compile and store the entire post-exploitation toolkit as Java schema objects inside the Oracle database . This approach made the toolkit invisible to standard OS-level defenses because EDR and antivirus tools focus on processes, binaries, and files on the operating system—they do not generally inspect Java classes and PL/SQL wrappers stored inside Oracle .
The khunt toolkit included these components, each stored as a database object:
Component
Function
KhuntCmd
Loads cmd.exe and executes arbitrary OS commands by embedding them in SQL statements sent to the database
KhuntHash
Extracts usernames and password hashes from Oracle's internal user tables and saves them to a file
KhuntFS / KhuntFS2
File explorers for listing, reading, searching, and checking file sizes on the compromised system
KhuntT
A simple "ping" tool to confirm the toolkit is installed and reachable before proceeding
KhuntUnzip
Utility for unzipping files
khunt_ PL/SQL wrappers*
PL/SQL wrapper procedures used to call the underlying Java methods
Achieving Full System Control: From Database to Windows OS
The attackers did not stop at database-level access. They used the khunt toolkit to pivot from the database layer to the underlying Windows operating system in a multi-step process:
OS command execution via KhuntCmd: They used the KhuntCmd module to run cmd.exe /c whoami, which confirmed they were running with SYSTEM-level privileges on the Windows server, establishing remote code execution (RCE) from the database to the OS .
Credential theft: They used PowerShell to invoke reg.exe and copy the SECURITY and SYSTEM registry hives, saving them as khuntSECURITY.hiv and khuntSYSTEM.hiv in F:\Oracle\.
Service enumeration: They ran tasklist /svc and saved the output as khunttasks.txt.
Additional hive extraction: They used esentutl.exe to copy the SAM and a second copy of the SECURITY hives, saving them as khuntSAM.hiv and khunt_SECURITY.hiv.
The exfiltrated registry hives could be used offline to extract and decode password hashes for all local accounts on the system .
Defense Blind Spots: Huntress's Key Findings
Huntress's investigation revealed several critical blind spots that allowed this attack to succeed and evade detection:
Database-as-beachhead shift: The database was transformed from a passive data store into an active attack platform, with the malicious toolkit living inside the database rather than on disk or in memory .
EDR/AV evasion: Traditional endpoint detection and response (EDR) and antivirus tools do not generally inspect Java classes and PL/SQL wrappers stored inside Oracle, making the toolkit invisible to standard OS-level defenses .
Classic vulnerability, novel delivery: The initial SQL injection was a well-known bug class. No zero-day was needed. The autocomplete search feature was enough to reach PL/SQL and then the OS, showing that basic input validation failures can lead to deep compromise when the database engine has OS-level capabilities .
Overprovisioned database accounts: Even after a SQL injection succeeds, the damage is limited if the database user account lacks privileges to author Java sources or execute stored procedures. Organizations often overprovision database accounts, giving attackers the extra permissions needed to deploy khunt .
Mitigations Recommended by Huntress
Based on this attack, Huntress recommended several mitigations :
Proper input sanitization and query parameterization for all web inputs
Restricting database user privileges so that even injected queries cannot create Java sources or execute arbitrary stored procedures
Expanding monitoring scope to include database objects (Java classes, PL/SQL wrappers) rather than only OS-level artifacts
This attack serves as a stark reminder that database engines with built-in programming environments (like Oracle's JVM) can become stealthy attack platforms when combined with even a single unvalidated input field. Security teams must extend their monitoring beyond the operating system to include the database object layer.
ibgids.nl
Hackers installeren khunt toolkit via SQL-injectie in Oracle ...
