I spent part of the day refining and testing out a little perl script. If you have a few preliminary bits of information it's possible to force a download of Cisco IOS router configs. There are a few more parts that have to align correctly but I'll clean up the code, grab a few screenshots and such. Nothing shatteringly new as I also found an old SNMP patch to do source spoofing as published in Phrack ... Unfortunately the patch was for a very old version of ucd-snmp so converting it to net-snmp is on my TODO list.
The perl script is just cooler. :)