This 'classic' decades-old SQL injection flaw could let hackers take over entire Windows servers, thanks to a nifty database trick
Huntress spotted a white whale - a malicious toolkit stored as a database object.
Security researchers Huntress detected a combination of a classic SQL Injection (SQLi) attack and a clever database trick to fully compromise Windows servers. The attack began when a public-facing application with an Oracle backend executed SQL commands input through a form without proper validation. This oversight allowed attackers to upload a database-resident post-exploitation toolkit called khunt.
While SQLi has been discussed in the cybersecurity community, the specific use of khunt in the wild remains relatively rare. Khunt, once installed, enabled attackers to carry out various malicious activities such as running arbitrary OS commands, stealing user credentials, listing and searching through files, unzipping files, and most notably, copying Windows Registry hives.
These hives contained critical password hashes for local accounts, which could be used to further exploit the system. To prevent such attacks, Huntress recommends implementing proper input sanitization and query parameterization to avoid injectable forms. Additionally, they advise ensuring that user accounts with query execution permissions are not overprovisioned, meaning they should not have the ability to execute Java sources or run stored procedures.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
