Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine. Huntress, which tracks the toolkit as khunt,

The article reports that attackers exploited a SQL injection flaw in a public-facing Java/Tomcat application to compromise an Oracle database and install the khunt post-exploitation toolkit as Java and PL/SQL schema objects compiled inside the database engine, then used it to execute Windows SYSTEM-level commands without dropping traditional executables to disk.[1][2][3][8] Huntress documents that components like KhuntCmd, KhuntHash, and KhuntFS were used to run cmd.exe, extract Oracle user data, and manage files directly from within the database, taking advantage of Oracle’s embedded JVM and overly privileged database accounts.[1][2][3] From a RealGround perspective, this demonstrates how complex, embedded runtime environments (like Java inside databases) and misconfigured privileges in core infrastructure form a critical part of the AI and software supply chain that can be abused to achieve stealthy, high-privilege code execution. Organizations should treat database engines, embedded VMs, and application service identities as supply-chain components, applying SBOM-style inventory to Java/PL/SQL objects and restricting runtime execution permissions and OS credentials to reduce bla