Forensic incident reports have exposed a stealthy post-exploitation technique where threat actors utilize an unauthenticated web application flaw to compile custom attack toolkits directly inside relational database memory structures. The approach allows adversaries to achieve command execution without dropping traditional executable files on server disks.
The attack chain begins by exploiting an unauthenticated SQL injection vulnerability in a public-facing web application running on Apache Tomcat. Attackers pass malformed autocomplete search queries to execute raw SQL statements against a backend Oracle Database server. The actors leverage embedded Java Virtual Machine functionality via CREATE JAVA SOURCE statements to compile and store a specialized Java toolkit dubbed khunt inside database schema objects. The stored Java components include command execution modules like KhuntCmd, which launch system shells and execute operating system commands via standard SQL queries.
Executing malicious payloads directly inside database engine memory bypasses endpoint detection and response tools reliant on disk file monitoring. Because database engines run with high system privileges, storing execution routines as database schema objects allows threat actors to maintain persistent hidden access, steal host credentials, and manipulate backend data records without generating file creation alerts.
– Perform comprehensive code audits on public-facing web application search endpoints to enforce parameterized SQL queries and eliminate SQL injection entry paths.
– Restrict Oracle Database user schema privileges to prevent non-administrative accounts from executing CREATE JAVA SOURCE or running external procedures.
– Inspect database schema objects for unrecognized Java sources, stored procedures, or unusual PL/SQL wrapper packages.
– Monitor database network traffic and query logs for anomalous administrative command strings or unexpected Java execution calls.
Database architecture security relies on strict input sanitization at application tiers combined with least-privilege schema controls to ensure database virtual machines cannot be subverted into fileless command execution hosts. #CodeDefence #Oracle #Tomcat #SQLi #Khunt #FilelessMalware #AppSec #DatabaseSecurity
/
