Need help configuring CIS to allow a bash script execution

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

Hi,

Good day! I need help configuring CIS to allow a bash script to reboot my router over http using CURL.

I am using Latest CIS with default settings and am on Windows 10 Pro 64bit.

The script itself works fine without CIS.

Many thanks in advance.

Regards
Shyam

#2

Just unblock the script from the unblock applications task.

#3

Hi futuretech,

Thanks for getting back. The script itself is not blocked but when I execute it, Login fails. Like I have mentioned, script uses CURL to access the local http://localhost/… to login to the router. This bit fails.

Without CIS, I can login successfully and reboot the router.

Regards
Shyam

#4

Have you tried disabling the firewall, hips, auto-containment, and web-filter instead of uninstalling to see if it works? What OS are you using and for curl are you using it through Cygwin?

#5

Hi futuretech,

Thanks again for getting back. I just tried disabling the above and also antivirus, still no joy! I am on Windows 10 Pro 64 bit. I am using CURL through GIT.

#6

Add cURL and/or git to the exclusions of detect shellcode injections.

#7

Thanks futuretech. I did try excluding my script itself and also couple of executables including what you have mentioned bash, ssh, curl, perl, etc… but no joy!

But then I thought why not exclude the entire GIT folder. When I tried it, Voila! It worked. Later I drilled down to isolate executables and it boiled down to just bash.exe in a different subfolder. Please see attached.

Thanks for all your help. I really appreciate it! :slight_smile:

The above does help my cause but on a broader prospective it is dangerous to let go an executable which can be exploited. Isnt it? Can there be no simple solution like just excluding my script under shell code injections? This way it will be a lot safer. Please let me know if this is a possibility.

#8

It will be fine as many exploits just attempt to download and execute malware or run embedded commands which will still be caught by HIPS, VirusScope, and auto-containment depending on how you have CIS configured. Also the name if that setting is misleading as CIS no longer detects shellcode injections from buffer overflow exploits. All this setting does is tell CIS not to inject the guard.dll into the listed applications. Also a script is just a normal file that contains commands to be processed by an interpreter which is the actual executable that carries out the commands.

#9

Thanks Futuretech. Thats reassuring! I am at peace now. Greatly appreciate your help!

Have a good day!