Keeper
A Request Tracker instance uses default admin credentials, and a user's comment leaks the lnorgaard SSH password. A KeePass database dump is cracked with CVE-2023-32784 to recover the master password, and the vault yields root's PuTTY private key, which is converted to an OpenSSH key for a root shell.