Identifier / Programs / Linux and Unix
cowsay
Print ASCII art (by default a cow) saying or thinking something. tldr-pages
GTFOBins inherit 1 documented command
How cowsay is abused
inherit
-fEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cowsay.
1 documented command
inherit unprivileged, with sudo
cowsay -f /path/to/script.pl xIdentifyThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cowsay. The identifier reads the line that runs cowsay.
Everyday use
Print an ASCII cow saying "hello, world"
cowsay "hello, world"IdentifyPrint an ASCII cow saying text from stdin
echo "hello, world" | cowsayIdentifyList all available art types
cowsay -lIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.