if private and/or public are still configured as snmp-server community strings (or you know what the non-default configured string might be), then one can grab the configuration via snmp. I believe you only need to have 'read' access to pull the config, but I may be mistaken on that point.

this is where the kind of tool that Phish pointed out is useful.

Cheers,
<0