Here's a useful post, getting GI's root password is similiar to controller's : https://patriciocerda.com/vmware-nsx-acceso-tech-support-mode-para-nsx-controllers/
1. You need to access NSX manager's root shell : refer VMware Knowledge Base
2. run /home/secureall/secureall/sem/WEB-INF/classes/GetEpsecAppliancePassword.sh
And be careful with the above operations!
Please consider marking this answer "correct" or "helpful" if you think your query have been answered correctly.
Cheers,
Matt Zhang
VCIX-NV | VCP-NV-CMA-DTM | CCDA | CCIE R&S