I would probably set up an apache page that cloned the interface of the router then add some type of warning about security update. He will most likely just type in the credentials to see what is going on and they will be sent straight to you. An easy way to do this is to use setoolkit i believe. with a little bit of html addition to the original page it will look very legit and and create a level of urgency that will require his attention.
https://www.youtube.com/watch?v=kGcdeAPMmfsthat is only the first part because then you have to cause him to open it, it is best if it just pops up when he tries to open a webpage and looks like a router alert or update that requires his information to continue. you will need him to connect to your ip somehow. DNS spoofing is the best way unless you have physical access to his computer. This may cause problems however as there are many people using this network it sounds like. If you can forward most responses to regular dns then only change the response for a certain page that he is most likely to use but not the other residents then you have a chance. another option is to give him a link to the page you have created and hope he opens it, not always reliable.
I am not going to try and give you a walkthrough on how to do this since every situation is different but this may be an option to look into if you really need to get into the router. Once you have the router the game becomes much easier because then you can use site cloning and set up dns in the router in many routers to link a specific page search to your clones(ie facebook, gmail, or whatever other credentials you would like to grab)
hope this has been helpful and gives you something to learn about
noSec
p.s. way too many emotocons dude
