Attackers exploited a SQL injection vulnerability in a public-facing web application to compromise an Oracle database, then deployed a post-exploitation toolkit called 'khunt' by compiling Java source code directly within the database engine rather than writing executables to disk. This technique allowed them to execute commands from inside Oracle and escalate privileges to Windows SYSTEM level ac
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine. Huntress, which tracks the toolkit as khunt,
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
