khunt

SQL Injection in Oracle Escalates to SYSTEM Execution on Windows via Embedded Java Compilation

A real-world intrusion chain demonstrates how a basic SQL injection can lead to command execution on Windows with SYSTEM privileges. Attackers leveraged Oracle Database's ability to load, compile, and run Java code inside the database engine itself. After gaining initial database access through an internet-exposed application, the threat actors introduced Java source code, converted it into schema objects, and compiled it directly on the server. This technique, tracked under the artifact name khunt and linked to Huntress telemetry, minimizes reliance on traditional disk binaries and shifts tooling into the less-monitored database engine. When the Oracle process runs with elevated rights on Windows, the chained execution inherits high privileges up to SYSTEM level. The incident underscores the need for parameterized queries, disabling unnecessary Java functionality in Oracle, and monitoring specific DDL events such as CREATE JAVA SOURCE and CREATE JAVA CLASS.