If your ultimate goal is to actually get the password in plain text, then unless there's severe misconfiguration or undiscovered flaw in the password hashing method used, then no, there isn't a faster way to crack password than brute force.
Few points you could exploit: if you can get the shadow file out of the system, you could do brute force in more resourceful cloud systems like AWS or Compute Engine. Or if you can get the password salt and/or iteration count ahead ahead of time, you may be able to precompute a rainbow table.
However, most attack scenarios don't really need the plain text of the password. If you already have root, you can already do everything you ever needed to do, install ssh key for future login, alter sudoers to gain privilege on your non-root account, alter the kernel/OS to hide your changes, delete logs, etc.
If you really needed the plain text of the password, you can try altering sudo/su/sshd/bash/gpg binary to a trojaned version so that the next time the real admin typed in root password, the password will be sent to you. This may be helped by a little social engineering to convince the real admin to login to the system sooner rather than waiting indefinitely for that to happen who knows when.