# Inside an Oracle Database SQL Injection Attack

SQLi in a public Tomcat app's autocomplete form let an attacker inject Oracle Java source objects, achieving OS command execution and dumping registry hives.

- Payout: Real-world hack
- Severity: critical
- Program: Oracle Database
- Credited: Huntress
- Disclosed: 2026-08-05
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/khunt-malware-sql-injection-oracle
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-khunt-malware-sql-injection-oracle
- Tags: domain:infra domain:web impact:data-leak impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:source-review vuln:rce vuln:sqli

**Target:** Public-facing Java/Tomcat application with Oracle backend via JDBC
**Root cause:** Autocomplete search form accepted unsanitized input that was passed through JDBC to Oracle, allowing arbitrary SQL/PL/SQL execution; the DB account could author Java sources, enabling in-database code compilation.
**Steps:**
1. Identify injectable autocomplete/search form on public Tomcat app (attacker IP 178.162.151[.]229).
2. Inject SQL through the form; commands flow via JDBC to Oracle.
3. Use `CREATE JAVA SOURCE` to compile attacker Java inside Oracle's embedded JVM as schema objects (khunt toolkit).
4. Create PL/SQL wrappers `khunt_*` to invoke Java methods.
5. Run `KhuntCmd` to execute `cmd.exe /c whoami`, confirming SYSTEM-level RCE.
6. Use PowerShell to invoke `reg.exe` copying SECURITY/SYSTEM hives to `F:\Oracle\khuntSECURITY.hiv`/`khuntSYSTEM.hiv`.
7. Run `tasklist /svc` to `F:\Oracle\khunttasks.txt`.
8. Copy SAM/SECURITY hives via `esentutl.exe` to `F:\Oracle\khuntSAM.hiv`/`khunt_SECURITY.hiv`.
**How found:** Huntress was alerted to credential-theft detections where reg.exe was spawned by oracle.exe; tracing the parent process and reviewing Apache access.log revealed the injectable autocomplete endpoint and attacker IP.
**Exploitation:** Attacker used SQLi in a public form to reach PL/SQL, then abused Oracle's embedded JVM via CREATE JAVA SOURCE to install khunt modules (KhuntCmd, KhuntHash, KhuntFS, KhuntT, KhuntUnzip). KhuntCmd spawned cmd.exe from oracle.exe, confirming SYSTEM RCE; then dumped registry hives (SAM, SECURITY, SYSTEM) for offline credential extraction.
**Escalation:** Pivoted from database-layer SQLi to OS-level RCE via Oracle JVM, then to credential theft by dumping registry hives.
**Insight:** Oracle's embedded JVM plus CREATE JAVA SOURCE turns any SQLi into OS RCE if the DB user can author Java; check whether the injection point's DB account has Java/stored-proc privileges, and hunt for khunt_* PL/SQL wrappers and KHUNT% in SQL logs rather than relying on EDR.