Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into …
Intelligence analysis by Llama
Attackers exploited a SQL injection flaw in a public-facing web application to gain access to an organization's Oracle database. They then installed a post-exploitation toolkit, known as khunt, which allowed them to run arbitrary operating-system commands and access sensitive files.
Imagine you have a super powerful computer that can do anything you tell it to do. Attackers found a way to trick this computer into doing bad things, like giving them access to secret files. They did this by sending the computer a special kind of code that it didn't know was bad. The computer thought it was just doing its job, but really it was helping the attackers. This is like a big security problem, and we need to fix it so that the computer can't be tricked into doing bad things.
Analysis
The Attack Vector: SQL Injection Flaw in Public-Facing Web Application
The attackers exploited a SQL injection flaw in a public-facing web application, which allowed them to inject malicious code into the database. This flaw was not patched, and the attackers were able to use it to gain access to the database.
The Post-Exploitation Toolkit: khunt
The attackers then installed a post-exploitation toolkit, known as khunt, which allowed them to run arbitrary operating-system commands and access sensitive files. This toolkit was not detected by endpoint detection and response products, as it was stored in the database as a schema object.
The Technique: Using Oracle's Embedded Java Virtual Machine
The attackers used Oracle's embedded Java Virtual Machine to compile and store Java code in the database. This code was then executed by the database engine, allowing the attackers to run arbitrary commands.
The Fix: Parameterized Queries and Input Validation
The fix for this vulnerability is to implement parameterized queries and input validation in the web application. This will prevent attackers from injecting malicious code into the database and prevent the installation of post-exploitation toolkits.
The Importance of Least Privilege Access
The importance of least privilege access cannot be overstated. In this case, the attackers were able to install the post-exploitation toolkit because the account serving the public-facing web application had enough privilege to create Java sources and run stored procedures. By implementing least privilege access, organizations can prevent attackers from installing post-exploitation toolkits and gaining access to sensitive files.
Key points
- Attackers exploited a SQL injection flaw in a public-facing web application to gain access to an organization's Oracle database.
- They then installed a post-exploitation toolkit, known as khunt, which allowed them to run arbitrary operating-system commands and access sensitive files.
- The attackers used Oracle's embedded Java Virtual Machine to compile and store Java code in the database.
- The fix for this vulnerability is to implement parameterized queries and input validation in the web application.
- The importance of least privilege access cannot be overstated.
If this vulnerability is patched and organizations implement proper input validation and parameterized queries, the risk of attackers exploiting this flaw will decrease. Additionally, by implementing least privilege access, organizations can prevent attackers from installing post-exploitation toolkits and gaining access to sensitive files.
If organizations do not patch this vulnerability and implement proper input validation and parameterized queries, the risk of attackers exploiting this flaw will remain high. Additionally, if attackers are able to gain access to sensitive files, they may be able to use this information to launch further attacks.
