You don't need a username and password for shell access if the application has a vulnerability that allows for arbitrary code execution. Your code just executes as the same user as the application. To elevate your privileges, you would need to use a separate vulnerability once you have shell access.