Thanks, and great question. During our exploration of the first box we popped, we noticed that most of the services on the host had their code and configuration

Thanks, and great question. During our exploration of the first box we popped, we noticed that most of the services on the host had their code and configuration in /usr/inversoft (or /usr/local/inversoft, I can't remember which exactly). So when we got our shell on the app server, that was the first place we looked, and luckily it didn't take long to find a config file containing Passport credentials.