Could you have used ssh? It might have been as easy as using nftp to upload a new /root/.ssh/authorized_keys file. Or not, depending on how they have ssh configured.
Author here. I talk a little bit about SSH in the end, if I was successful in breaking the root password and if sshd is configured for root access (I'm not sure), I could have just used that. Otherwise, for me to change authorized_keys or some other file to run some code as root, it's the same work.
Inspired by another post here on HN: https://news.ycombinator.com/item?id=32447650