# Attackers Compile khunt Toolkit Inside Oracle Database to Escalate SQL Injection to Windows SYSTEM Access

> Huntress DFIR investigation (July 2026) revealed an intrusion where attackers exploited a SQL injection vulnerability in a public-facing Java/Tomcat application to gain initial access to an Oracle database, then used the database's embedded JVM via CREATE JAVA SOURCE to compile the khunt post-exploitation toolkit as fileless Java schema objects, achieving SYSTEM-level code execution on the underlying Windows Server and dumping SAM/SECURITY registry hives for credential theft.

- **Published:** 2026-08-06T00:00:00Z
- **Last reviewed:** 2026-08-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1910
- **ID:** TL-2026-1910
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In July 2026, Huntress detected credential-theft alerts on a server hosting an Oracle database, triggering a DFIR investigation that uncovered a multi-stage intrusion chain. The attack began with a SQL injection vulnerability in a public-facing Java/Tomcat web application — specifically an autocomplete search field that passed unvalidated user input to the Oracle database via a JDBC connection without prepared statements or input sanitization. The database account serving the application held excessive privileges, including the ability to create Java source and procedure schema objects.

The attacker exploited Oracle's embedded Java Virtual Machine (JVM) using the CREATE JAVA SOURCE statement — a legitimate Oracle feature that compiles and stores Java source code as a persistent database schema object, entirely fileless on the operating system. This technique was first publicly documented by Marco Ivaldi's raptor_oraexec.sql in 2006 but has rarely been observed in the wild. The attacker compiled the khunt post-exploitation toolkit, consisting of six Java objects (KhuntCmd, KhuntHash, KhuntFS, KhuntFS2, KhuntT, KhuntUnzip) accessed via PL/SQL wrapper procedures stored as Oracle schema objects.

Using KhuntCmd, the attacker executed cmd.exe /c whoami through the Oracle JVM, confirming SYSTEM-level privileges on the Windows Server. All malicious process activity originated from the oracle.exe parent process, bypassing traditional EDR and antivirus tools that do not inspect Java classes and PL/SQL wrappers inside Oracle databases. The attacker then conducted credential theft using living-off-the-land Windows binaries: reg.exe to copy SECURITY and SYSTEM registry hives, and esentutl.exe to copy SAM and SECURITY hives, storing them as F:\Oracle\khunt*.hiv files. System service enumeration was performed via tasklist /svc, saved to F:\Oracle\khunttasks.txt. Huntress confirmed local staging of these files but could not establish whether exfiltration occurred.

The attacker's source IP was traced to 178.162.151.229 (LeaseWeb Netherlands B.V., AS60781) via Apache access.log analysis. No specific threat actor attribution was made. This intrusion is notable for the fileless deployment of post-exploitation tooling inside the Oracle database, the use of an Oracle JVM technique that has been publicly documented for two decades but rarely exploited in the wild, and the complete kill chain from SQL injection through database-to-OS escape to SYSTEM-level credential theft.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1611 Escape to Host
- T1564 Hide Artifacts
- T1140 Deobfuscate/Decode Files or Information
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1007 System Service Discovery

## Sources

- [Inside an Oracle Database SQL Injection Attack — Huntress](https://www.huntress.com/blog/khunt-malware-sql-injection-oracle)
- [Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access — The Hacker News](https://thehackernews.com/2026/08/attackers-compile-khunt-inside-oracle.html)
- [Hackers Run khunt Post-Exploitation Toolkit from Oracle Database — BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-run-khunt-post-exploitation-toolkit-from-oracle-database/)
- [raptor_oraexec.sql — Oracle JVM Command Execution via CREATE JAVA SOURCE — Exploit-DB](https://www.exploit-db.com/exploits/2837)
- [raptor_oraexec.sql — 0xdea/exploits GitHub Repository](https://github.com/0xdea/exploits/blob/master/oracle/raptor_oraexec.sql)
- [FalconFriday 0xFF-0209 — Oracle Suspicious Command Execution Detection](https://github.com/FalconForceTeam/FalconFriday/blob/main/0xFF-0209-Oracle_Suspicious_Command_Execution-WIn.md)
- [OWASP Query Parameterization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet)
- [Oracle Database SQL Language Reference — CREATE JAVA](https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/CREATE-JAVA.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1910