You must be able to boot some rescue cd (centos has this) through KVM,
After booting the rescue, you should mount your system partition and be able to directly edit /etc/passwd in order to fix the shell.
In fact, if you choose centos rescue to try automatically find your partitions and mount them for you, there is a pretty big chance, the system will handle this and you will have ready mounts (so only the edit of passwd must be made). If the rescue mounts your partitions, they usually reside into: "/mnt/sysimage"
This video must be close enough to your steps in order to get into rescue mode:
The only prereqiusity is to find Centos 6.x ISO , mount it through KVM and boot from it.
You can get the ISO from some Centos mirror, which will look something like this:
http : //mirror.some_close_to_you_mirror.com/centos/6.8/isos/x86_64/CentOS-6.8-x86_64-netinstall.iso
Where "mirror.some_close_to_you_mirror.com" is one of the list here:
Hope this helps.