A newly documented attack method weaponizes Oracle's built-in Java capabilities to achieve full system control from a simple SQL injection, completely evading disk-based security tools. Security researchers at Huntress, tracking the toolkit as khunt, detail how attackers are compiling malicious code directly within database schemas, turning database infrastructure into a stealthy command-and-control hub.
The attack begins when an adversary exploits a SQL injection flaw in a public-facing application to gain initial database access. Once inside, the attacker avoids traditional malware delivery by injecting raw Java source code directly into the Oracle database engine.
Oracle databases ship with an integrated Java compiler, a feature designed for building stored procedures. The khunt toolkit abuses this function by having the database itself compile the malicious Java code into internal schema objects. This "fileless" method ensures the payload never resides as a standalone file on the host system's disk, rendering conventional antivirus and endpoint detection and response (EDR) solutions ineffective.
The critical escalation occurs because the compiled Java routines execute within the context of the database service account. On many Windows deployments, this account is granted high-level operating system privileges, frequently including SYSTEM access. This grants the attacker immediate remote command execution, persistence, and the ability to move laterally across the network, all while operating under the guise of the database process.
This technique highlights a significant monitoring blind spot in many enterprises. Security operations often segregate database management from endpoint and network monitoring. This division means that malicious activity contained within the database process—such as anomalous Java compilation—goes unnoticed. The khunt campaign effectively turns the database server itself into a covert operational base.
Defending against this threat requires a strategic pivot toward internal database auditing. The foremost priority is to eliminate the initial access vector by rigorously patching SQL injection vulnerabilities in all web applications. Administrators must also re-evaluate the principle of least privilege for Oracle service accounts, ensuring they operate without excessive OS-level permissions to contain potential breaches.
Detection depends on deep visibility into database internals. Security teams should enable detailed logging for Java-related activities within Oracle. Key indicators of compromise include unauthorized Java compilation events, the creation or modification of Java-based stored procedures, and any unexpected OS commands originating from the database process. Regular, automated schema audits are essential for identifying rogue objects.
As databases evolve into complex, multi-language platforms, the khunt campaign demonstrates the obsolescence of perimeter-only defense. Integrating database telemetry into core threat detection frameworks is no longer optional; it is a necessity for securing the critical data and services housed within these engines.
一種新近記錄的攻擊手法將Oracle內建的Java功能武器化，透過簡單的SQL注入便可取得完整的系統控制權，同時完全避開基於磁碟的安全工具。安全研究機構Huntress將該工具包追蹤為「khunt」，詳細描述了攻擊者如何直接在數據庫架構內編譯惡意代碼，將數據庫基礎設施轉化為隱蔽的命令與控制中心。
攻擊始於攻擊者利用面向公網的應用程式中的SQL注入漏洞，以取得初步的數據庫存取權限。一旦進入系統，攻擊者會避開傳統的惡意軟件投放方式，直接將原始Java源代碼注入Oracle數據庫引擎中。
Oracle數據庫內置集成Java編譯器，這項功能原本用於建構儲存程序。khunt工具包濫用此功能，讓數據庫自身將惡意Java代碼編譯成內部架構物件。這種「無檔案」方法確保惡意載荷永遠不會作為獨立檔案存儲在主機系統的磁碟上，使傳統防毒軟件及端點偵測與回應（EDR）解決方案無效。
關鍵的權限提升發生在編譯後的Java例程在數據庫服務帳戶的上下文中執行。在許多Windows部署中，此帳戶被授予高層級的作業系統權限，通常包括SYSTEM存取權限。這使攻擊者能立即實現遠端命令執行、維持持久性存取，並具備在網絡中橫向移動的能力，同時全程偽裝為數據庫進程的運作。
此技術凸顯了許多企業中一個顯著的監控盲點。安全營運通常將數據庫管理與端點及網絡監控分離開來。這種分離意味著包含在數據庫進程內的惡意活動——例如異常的Java編譯——不會被發現。khunt活動有效地將數據庫伺服器本身轉化為秘密的行動基地。
防禦此威脅需要策略性轉向內部數據庫審計。首要任務是透過嚴格修補所有Web應用程式中的SQL注入漏洞來消除初始存取向量。管理員還必須重新評估Oracle服務帳戶的最低權限原則，確保其在沒有多餘的作業系統級別權限下運作，以遏制潛在入侵。
偵測依賴於對數據庫內部的深度可見性。安全團隊應在Oracle中啟用與Java相關活動的詳細日誌記錄。關鍵的入侵指標包括未經授權的Java編譯事件、基於Java的儲存程序的創建或修改，以及任何源自數據庫進程的意外作業系統命令。定期的自動化架構審計對於識別異常物件至關重要。
隨著數據庫演變為複雜的多語言平台，khunt活動證明了僅依賴邊界防禦的過時性。將數據庫遙測數據整合到核心威脅偵測框架中不再是可選項；這已成為保護這些引擎中儲存的關鍵數據和服務的必要措施。