Why can't you use the ssh=password boot parameter in GRML? When you do that I think the username is grml with whatever password you gave it. I don't know if that is in all versions of GRML but if it is you should be able to do whatever you need. But my elderly brain doesn't work as well as it should any more!
