[pstrateman]

Interesting that they didn't try to brute force the shadow file.

[perlgeek]

They mentioned that the shadow file was empty before they set their own root password.

So, nothing to brute-force except the two public SSH keys, which seem (eyeballing from the length of the key) to be at least 2048 bit RSA keys.