How about a ping sweep of the subnet? It should give you a listing of active IPs. This should be able to start narrowing your choices for the default gateway but probably won't reveal the DNS server.
It won't blantantly tell you that an IP is the default gateway but once you have a listing of active IPs, chances are the default will be the first or last IP in that subnet.


