Name: How khunt turned Oracle SQL injection into Windows SYSTEM
Uploaded: 2026-08-06T09:00:00+00:00
Duration: 48 s
Description: Attackers exploited a SQL injection flaw in a public web app to compile a post-exploitation toolkit called khunt directly inside an Oracle database, using CREATE JAVA SOURCE to gain SYSTEM-level command execution on the Windows host without writing malware to disk. Huntress disclosed the case on August 5, 2026.

How khunt turned Oracle SQL injection into Windows SYSTEM.

Security · 2026-08-06 · 48s

Attackers exploited a SQL injection flaw in a public web app to compile a post-exploitation toolkit called khunt directly inside an Oracle database, using CREATE JAVA SOURCE to gain SYSTEM-level command execution on the Windows host without writing malware to disk. Huntress disclosed the case on August 5, 2026.

Read the full story: khunt Turns Oracle SQL Injection Into Windows SYSTEM →

Transcript

Here is a nasty one. Attackers hit a public web app through an autocomplete search box, found a SQL injection bug, and instead of just stealing data, they compiled their own malware inside the Oracle database. Oracle ships with a Java virtual machine built in. So they used create java source to plant six Java objects right in the schema, wrapped them in PL SQL, and got command execution. Nothing was written to disk. Then they ran whoami, and it came back as SYSTEM, because on Windows the database service usually runs with full local rights. From there they copied the registry hives to steal password hashes. Huntress published the whole case on August fifth. The fix is not a patch. It is checking which accounts in your database can create procedures, because that one privilege is the entire attack chain.