Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers exploited a SQL injection vulnerability in a publicly accessible web application to gain access to an organization's Oracle database. They then used the database to compile and run malicious Java code, installing a post-exploitation toolkit known as khunt without creating any executable files on disk. The attackers leveraged Oracle's ability to compile Java code into stored schema objects, allowing them to execute commands from within the database engine itself. This approach enabled them to ultimately achieve Windows SYSTEM access. The toolkit was tracked by Huntress, a security firm. The attack highlights the potential for SQL injection flaws to be used as a stepping stone for further exploitation.