@petelska said:
The private key doesn’t seem password protected to me. If it were, the prompt would ask for the key passphrase - not password.
The password prompt appears because the private key you found is not valid to be used on the server and your login attempt falls through to regular password-based authentication .
You are probably right. Although I tried adding pub cert from this location to authorized_keys, and then using priv key pair to login - in theory this should work but it didn’t. That is why I assumed they are password protected. Anyway I’m going back to the drawing board with my RCE one-liner as other people suggested.