That was the root password, and remote root was disabled, so they had to social engineer an account that could remote in over ssh so they could su to do the rea

That was the root password, and remote root was disabled, so they had to social engineer an account that could remote in over ssh so they could su to do the real damage.