Hi All 

quick background;
SNAP UFB customer
run own firewall/gw to make internet connection. 
Use fritz for voip and wifi only

Snap can be a real pain to deal with at times and it depends on which operator you get.  

In the past when ever I had voip issues with my fritz it was pretty straight forward to get support for it, the operator would remote in and make changes and I would be away laughing(or chatting on the phone).

However, I was having issues with my wifi on the fritz and snap suggested that the device might be faulty so sent me a new one. I then went about setting up the new one by copying the settings. I called snap to get help with the voip part. They said the only supported method now is to auto configure the device automatically by plugging it directly into the ONT and leaving it like that. I had problems with this as it will ruin all my network setup and I would be left with a device susceptible to toll fraud because it is externally accessible from the internet - Ive seen the posts

Anyway, Frustrated at this I just plugged back in the old one and went to use that for VOIP and was told that the only way to get voip now was to use a managed fritz which is on the edge of the network and is auto configured by snap. I managed to talk the operator into logging into my fritz and setting up the voip again, even though it was working before. It was giving a 401 error which is "Bad Password" so I am guessing all he did was update the password.

So here I am with my old fritz working again on the voip and I start to google....

I quickly found that Telnet can be enabled on the fritz by dialling a code into a connected phone:

Turn Telnet On: #96*7*
Turn Telnet Off: #96*8*

I then found the settings for voip can be extracted by connecting to the fritz with a putty telnet session and using 

nvi /var/flash/voip.cfg

This output the config but the password was hashed!! :(

so back to google and I found the password can be extracted easily by running these two commands in the telnet session:

allcfgconv -C voip -o /var/tmp/temp -c
cat /var/tmp/temp |grep passwd

And there you go, it output my voip password in plain text.

I used this to configure the new fritz and without connecting to the edge of the network to be automatically configured and without needing to give snap remote access.

So there you go, you can just extract your voip password from a working fritzbox and use it configure any device you choose. 

Thanks Snap!