{"id":1909,"date":"2026-08-10T07:23:32","date_gmt":"2026-08-10T00:23:32","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-khunt-cong-cu-hau-khai-thac-chay-truc-tiep-trong-oracle-database\/"},"modified":"2026-08-10T07:23:32","modified_gmt":"2026-08-10T00:23:32","slug":"khunt-oracle-database-post-exploitation-toolkit-alert","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-khunt-cong-cu-hau-khai-thac-chay-truc-tiep-trong-oracle-database\/","title":{"rendered":"khunt Alert: Post-Exploitation Toolkit Runs Directly Inside Oracle Database"},"content":{"rendered":"

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u Huntress cho bi\u1ebft m\u1ed9t nh\u00f3m t\u1ea5n c\u00f4ng \u0111\u00e3 khai th\u00e1c l\u1ed7 h\u1ed5ng SQL injection tr\u00ean \u1ee9ng d\u1ee5ng Java public-facing \u0111\u1ec3 c\u00e0i c\u00f4ng c\u1ee5 h\u1eadu khai th\u00e1c khunt tr\u1ef1c ti\u1ebfp v\u00e0o Oracle Database, thay v\u00ec th\u1ea3 t\u1ec7p th\u1ef1c thi truy\u1ec1n th\u1ed1ng tr\u00ean m\u00e1y ch\u1ee7.<\/p>\n

\"Trung<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd c\u1ee7a v\u1ee5 vi\u1ec7c<\/h2>\n

Theo BleepingComputer, v\u1ee5 t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c Huntress ph\u00e1t hi\u1ec7n ng\u00e0y 27\/7\/2026 sau khi n\u1ec1n t\u1ea3ng gi\u00e1m s\u00e1t c\u1ee7a h\u00e3ng ghi nh\u1eadn d\u1ea5u hi\u1ec7u \u0111\u00e1nh c\u1eafp th\u00f4ng tin x\u00e1c th\u1ef1c tr\u00ean m\u1ed9t m\u00e1y ch\u1ee7 ch\u1ea1y Oracle Database. Nh\u1eadt k\u00fd Apache cho th\u1ea5y \u0111i\u1ec3m v\u00e0o l\u00e0 m\u1ed9t endpoint t\u00ecm ki\u1ebfm t\u1ef1 \u0111\u1ed9ng ho\u00e0n th\u00e0nh trong \u1ee9ng d\u1ee5ng Java ch\u1ea1y tr\u00ean Apache Tomcat.<\/p>\n

\u1ee8ng d\u1ee5ng kh\u00f4ng x\u00e1c th\u1ef1c ch\u1eb7t d\u1eef li\u1ec7u \u0111\u1ea7u v\u00e0o, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng g\u1eedi l\u1ec7nh SQL t\u1edbi c\u01a1 s\u1edf d\u1eef li\u1ec7u Oracle. T\u1eeb \u0111\u00f3, nh\u00f3m t\u1ea5n c\u00f4ng c\u00e0i khunt d\u01b0\u1edbi d\u1ea1ng Java object b\u00ean trong database, t\u1eadn d\u1ee5ng Java Virtual Machine nh\u00fang c\u1ee7a Oracle v\u00e0 kh\u1ea3 n\u0103ng l\u01b0u, bi\u00ean d\u1ecbch m\u00e3 Java b\u1eb1ng c\u00e2u l\u1ec7nh CREATE JAVA SOURCE<\/code>.<\/p>\n

V\u00ec sao k\u1ef9 thu\u1eadt n\u00e0y nguy hi\u1ec3m<\/h2>\n

\u0110i\u1ec3m \u0111\u00e1ng ng\u1ea1i l\u00e0 payload kh\u00f4ng nh\u1ea5t thi\u1ebft xu\u1ea5t hi\u1ec7n nh\u01b0 m\u1ed9t t\u1ec7p m\u00e3 \u0111\u1ed9c quen thu\u1ed9c tr\u00ean h\u1ec7 th\u1ed1ng t\u1ec7p. Khi Java object v\u00e0 PL\/SQL wrapper \u0111\u01b0\u1ee3c l\u01b0u trong schema database, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 th\u1ef1c thi l\u1ec7nh h\u1ec7 \u0111i\u1ec1u h\u00e0nh th\u00f4ng qua SQL n\u1ebfu t\u00e0i kho\u1ea3n \u1ee9ng d\u1ee5ng c\u00f3 \u0111\u1eb7c quy\u1ec1n qu\u00e1 r\u1ed9ng.<\/p>\n

Huntress ghi nh\u1eadn c\u00e1c th\u00e0nh ph\u1ea7n c\u1ee7a khunt c\u00f3 kh\u1ea3 n\u0103ng ch\u1ea1y l\u1ec7nh Windows, truy c\u1eadp b\u1ea3ng ng\u01b0\u1eddi d\u00f9ng n\u1ed9i b\u1ed9 c\u1ee7a Oracle, duy\u1ec7t v\u00e0 \u0111\u1ecdc t\u1ec7p, t\u00ecm ki\u1ebfm t\u1ec7p, ki\u1ec3m tra k\u00edch th\u01b0\u1edbc t\u1ec7p v\u00e0 gi\u1ea3i n\u00e9n d\u1eef li\u1ec7u. M\u1ed9t l\u1ec7nh ki\u1ec3m tra cho th\u1ea5y m\u00e3 \u0111\u01b0\u1ee3c th\u1ef1c thi v\u1edbi quy\u1ec1n SYSTEM tr\u00ean m\u00e1y ch\u1ee7 Windows, l\u00e0m t\u0103ng \u0111\u00e1ng k\u1ec3 r\u1ee7i ro leo thang h\u1eadu khai th\u00e1c.<\/p>\n

D\u1ea5u hi\u1ec7u v\u00e0 h\u1ec7 qu\u1ea3 c\u1ea7n l\u01b0u \u00fd<\/h2>\n

Sau khi c\u00e0i toolkit, k\u1ebb t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng PowerShell v\u00e0 ti\u1ec7n \u00edch Windows \u0111\u1ec3 sao ch\u00e9p c\u00e1c registry hive SAM, SECURITY v\u00e0 SYSTEM. \u0110\u00e2y l\u00e0 nh\u1eefng t\u1ec7p th\u01b0\u1eddng \u0111\u01b0\u1ee3c d\u00f9ng trong chu\u1ed7i \u0111\u00e1nh c\u1eafp ho\u1eb7c b\u1ebb kh\u00f3a th\u00f4ng tin x\u00e1c th\u1ef1c c\u1ee5c b\u1ed9. Nh\u00f3m t\u1ea5n c\u00f4ng c\u0169ng li\u1ec7t k\u00ea d\u1ecbch v\u1ee5 \u0111ang ch\u1ea1y b\u1eb1ng tasklist \/svc<\/code> v\u00e0 l\u01b0u k\u1ebft qu\u1ea3 v\u00e0o t\u1ec7p tr\u00ean h\u1ec7 th\u1ed1ng.<\/p>\n

BleepingComputer cho bi\u1ebft Huntress truy v\u1ebft y\u00eau c\u1ea7u \u0111\u1ed9c h\u1ea1i t\u1edbi \u0111\u1ecba ch\u1ec9 IP 178.162.151[.]229. B\u00e1o c\u00e1o hi\u1ec7n ch\u01b0a x\u00e1c nh\u1eadn d\u1eef li\u1ec7u registry \u0111\u00e3 b\u1ecb \u0111\u01b0a ra ngo\u00e0i hay ch\u01b0a, nh\u01b0ng chu\u1ed7i h\u00e0nh vi cho th\u1ea5y m\u1ee5c ti\u00eau r\u00f5 r\u00e0ng l\u00e0 m\u1edf r\u1ed9ng quy\u1ec1n ki\u1ec3m so\u00e1t sau khi x\u00e2m nh\u1eadp ban \u0111\u1ea7u.<\/p>\n

Khuy\u1ebfn ngh\u1ecb ph\u00f2ng th\u1ee7<\/h2>\n

C\u00e1c t\u1ed5 ch\u1ee9c v\u1eadn h\u00e0nh \u1ee9ng d\u1ee5ng web k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp t\u1edbi database c\u1ea7n r\u00e0 so\u00e1t l\u1ea1i l\u1edbp ki\u1ec3m tra \u0111\u1ea7u v\u00e0o, \u0111\u1eb7c bi\u1ec7t v\u1edbi c\u00e1c endpoint t\u00ecm ki\u1ebfm, autocomplete v\u00e0 truy v\u1ea5n \u0111\u1ed9ng. SQL injection v\u1eabn l\u00e0 r\u1ee7i ro c\u0169 nh\u01b0ng h\u1eadu qu\u1ea3 c\u00f3 th\u1ec3 nghi\u00eam tr\u1ecdng h\u01a1n khi t\u00e0i kho\u1ea3n database \u0111\u01b0\u1ee3c c\u1ea5p quy\u1ec1n v\u01b0\u1ee3t nhu c\u1ea7u nghi\u1ec7p v\u1ee5.<\/p>\n

V\u1edbi Oracle Database, c\u1ea7n h\u1ea1n ch\u1ebf nghi\u00eam ng\u1eb7t quy\u1ec1n t\u1ea1o Java source, quy\u1ec1n ch\u1ea1y stored procedure kh\u00f4ng c\u1ea7n thi\u1ebft v\u00e0 c\u00e1c \u0111\u1eb7c quy\u1ec1n qu\u1ea3n tr\u1ecb \u0111\u1ed1i v\u1edbi t\u00e0i kho\u1ea3n \u1ee9ng d\u1ee5ng public-facing. \u0110\u1ed9i v\u1eadn h\u00e0nh c\u0169ng n\u00ean gi\u00e1m s\u00e1t b\u1ea5t th\u01b0\u1eddng trong schema object, PL\/SQL wrapper, l\u1ec7nh t\u1ea1o Java object, truy c\u1eadp b\u1ea3ng ng\u01b0\u1eddi d\u00f9ng n\u1ed9i b\u1ed9 v\u00e0 h\u00e0nh vi sao ch\u00e9p registry hive tr\u00ean m\u00e1y ch\u1ee7 Windows.<\/p>\n

V\u1ee5 vi\u1ec7c khunt l\u00e0 l\u1eddi nh\u1eafc r\u1eb1ng ph\u00f2ng th\u1ee7 database kh\u00f4ng ch\u1ec9 d\u1eebng \u1edf b\u1ea3n v\u00e1 v\u00e0 t\u01b0\u1eddng l\u1eeda. Nguy\u00ean t\u1eafc \u0111\u1eb7c quy\u1ec1n t\u1ed1i thi\u1ec3u, logging \u0111\u1ee7 s\u00e2u v\u00e0 ki\u1ec3m tra \u0111\u1ecbnh k\u1ef3 c\u00e1c object l\u1ea1 trong database c\u00f3 th\u1ec3 quy\u1ebft \u0111\u1ecbnh kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n t\u1ea5n c\u00f4ng tr\u01b0\u1edbc khi k\u1ebb x\u00e2m nh\u1eadp chuy\u1ec3n sang \u0111\u00e1nh c\u1eafp th\u00f4ng tin x\u00e1c th\u1ef1c.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer v\u00e0 Huntress<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u Huntress cho bi\u1ebft m\u1ed9t nh\u00f3m t\u1ea5n c\u00f4ng \u0111\u00e3 khai th\u00e1c l\u1ed7 h\u1ed5ng SQL injection tr\u00ean \u1ee9ng d\u1ee5ng Java public-facing \u0111\u1ec3 c\u00e0i c\u00f4ng c\u1ee5 h\u1eadu khai th\u00e1c khunt tr\u1ef1c ti\u1ebfp v\u00e0o Oracle Database, thay v\u00ec th\u1ea3 t\u1ec7p th\u1ef1c thi truy\u1ec1n th\u1ed1ng tr\u00ean m\u00e1y ch\u1ee7. \u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd c\u1ee7a v\u1ee5 vi\u1ec7c Theo […]<\/p>\n","protected":false},"author":2,"featured_media":1907,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[602,484,320,603,598,599,601,600,402],"class_list":["post-1909","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-apache-tomcat","tag-credential-theft","tag-huntress","tag-java","tag-khunt","tag-oracle-database","tag-post-exploitation","tag-sql-injection","tag-tin-tuc-an-ninh-mang"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1909"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1909\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1907"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}