A post-exploitation toolkit has been found compiled and stored inside an Oracle database as schema objects, giving attackers command execution on the underlying Windows server from a location conventional endpoint tooling does not inspect.
Huntress detected the intrusion on July 27 after credential theft alerts fired on a host running an Oracle database server, and published its analysis on August 5. The entry point was SQL injection in the autocomplete search feature of a public-facing Java application running Apache Tomcat.
No vulnerability was involved. The application passed unvalidated input to the database over a Java Database Connectivity (JDBC) connection, using an account permissioned to create Java objects.
Read more on Oracle exploitation: Attackers Rapidly Weaponize Critical Oracle WebLogic RCE, Honeypot Study Finds
A Toolkit Compiled Inside the Database
Oracle’s database ships with an embedded Java Virtual Machine (JVM) and a statement that stores Java source code as a database object. The attacker fed that statement through the injection point, and Oracle compiled the code into stored schema objects.
The toolkit is named khunt, after the convention running through its module names and the files it wrote to disk.
Its components included a module that opened a Windows command shell for arbitrary operating system commands, and a credential dumper that read Oracle’s internal user table and wrote usernames and passwords to a file.
Alongside those sat two file explorers, an unzip utility, a reachability check to confirm the toolkit was live and a set of PL/SQL wrappers to call the underlying Java methods.
The technique itself is not new, though Huntress called its use here a novel aspect of the attack, noting that documented cases in the wild have been rare.
Where Endpoint Tools Do Not Look
The attacker pivoted from the database to the operating system by opening a Windows command shell, confirming SYSTEM-level privileges. They then used PowerShell to invoke the Windows registry tool, copying the SECURITY and SYSTEM hives, enumerated running services and copied the SAM and SECURITY hives with the Extensible Storage Engine utility.
Huntress assessed the hives were staged for credential dumping and probable exfiltration, describing the activity as an attempt rather than a confirmed theft. Apache access logs let researchers trace the requests to a single IP address.
The detection problem is the point Huntress emphasized. Storing the toolkit as a database object rather than a file or memory-resident payload leaves it outside the scope of most security tooling, since endpoint products focus on processes, binaries and files rather than Java classes and PL/SQL wrappers inside Oracle.
That, the firm said, turns the database from something attackers query for data into a foothold they can operate from.
“To avoid these types of attacks, it’s important to ensure the forms aren’t injectable,” Huntress wrote. “Practice proper input sanitization and query parameterization for any inputs. It’s also important to ensure that users with the ability to execute queries aren’t overprovisioned.”
