Cybersecurity researchers have uncovered a sophisticated attack where threat actors exploited a SQL injection vulnerability in a public-facing web application to gain SYSTEM-level access on a Windows server hosting an Oracle database. This method involved injecting Java source code directly into the database, allowing the attackers to execute commands without writing any files to disk.
The attack began with the exploitation of an autocomplete search field in the web application, which passed unvalidated input to the Oracle database via a Java Database Connectivity (JDBC) connection. The database account used by the application possessed sufficient privileges to create Java objects within the database schema.
By leveraging Oracle’s embedded Java Virtual Machine (JVM) and the CREATE JAVA SOURCE statement, the attackers introduced Java code that the database compiled and stored as schema objects. This approach enabled them to execute operating system commands from within the database environment, effectively transforming the database into an attack platform.
The post-exploitation toolkit, identified as ‘khunt,’ comprised several Java objects and PL/SQL wrappers:
- KhuntCmd: Executed arbitrary OS commands via cmd.exe.
- KhuntHash: Extracted usernames and password hashes from Oracle’s internal user table and saved them to a file.
- KhuntFS and KhuntFS2: Provided functionalities to list, read, search, and determine the size of files.
- KhuntT: Verified the toolkit’s operational status.
- KhuntUnzip: Decompressed archive files.
Utilizing KhuntCmd, the attackers executed commands such as ‘cmd.exe /c whoami,’ which returned ‘SYSTEM,’ indicating they had achieved the highest level of privilege on the server. Subsequent actions included using PowerShell and registry tools to copy critical registry hives and running tasklist commands to gather information about running services.
Notably, this technique is not new; similar methods have been documented as far back as 2006. However, its use in real-world attacks has been rarely observed until now. The attackers’ ability to execute commands without leaving traditional forensic artifacts, such as files on disk, poses significant challenges for detection and response.
To mitigate such risks, organizations should implement parameterized queries and rigorous input validation within their applications to prevent SQL injection vulnerabilities. Additionally, adhering to the principle of least privilege is crucial; database accounts used by applications should have only the necessary permissions required for their function, thereby limiting the potential impact of a compromised account.
This incident underscores the evolving tactics of cyber adversaries who are increasingly exploiting database functionalities to achieve their objectives. It highlights the need for comprehensive security measures that encompass application development practices, database management, and continuous monitoring to detect and respond to such sophisticated attacks.
