Mentor — Credentials

User	Password / Hash	Type	Source	Access Granted	Tested
(community)	internal	SNMP v2c community	snmpbrute (default public failed)	Full SNMP read	✓
(community)	public	SNMP v2c community	default guess	Rejected	✓ (fail)
bootstrap	SuperSecurePassword123__	SNMPv3 (MD5/DES)	/etc/snmp/snmpd.conf createUser line	SNMPv3 priv (also = james's system pw)	✓
admin (API)	kj23sadkj123as0-d213	API password	snmpwalk proc table: /usr/local/bin/login.py <pw>	Admin JWT on API → /admin/backup	✓
james	7ccdcd8c05b59add9c198d492b36a503 → yourmom	MD5 (app DB)	select * from users in container	API only (not system)	✓
service_acc (svc)	53f22d0dfa10dce7e29cd31f4f953fd8 → 123meunomeeivani	MD5 (app DB)	select * from users in container	SSH to host as svc	✓
postgres	postgres	DB password	/app/app/db.py DATABASE_URL	mentorquotes_db (from container)	✓
james	SuperSecurePassword123__	system password	reused from snmpd.conf bootstrap pw	SSH/su james → sudo /bin/sh → root	✓

Notes

• Password reuse is the spine of this box. The SNMPv3 createUser bootstrap ... SuperSecurePassword123__ value in /etc/snmp/snmpd.conf is also james's Linux login password. svc had to read that file first, so the DB-crack → svc SSH step is a prerequisite.
• MD5 hashes from the app DB cracked instantly on crackstation.net (unsalted MD5). james→yourmom, svc→123meunomeeivani.
• kj23sadkj123as0-d213 is NOT a Linux password — it's the admin login for the FastAPI app, leaked because login.py was invoked with the password as a CLI arg (visible in SNMP hrSWRunParameters / process table).
• Docker container gateway (host) = 172.22.0.1. Postgres listens there, reachable from the container only.