WiFi Toggling Script for AT&T BGW210 routers

wifi-toggle.ps1

$wifiUrl = 'http://192.168.1.254/cgi-bin/wmacauth.ha'
$deviceCode = ';)' # in plaint sight... ah well

function hex_md5($str) {
    $md5 = New-Object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider
    $utf8 = New-Object -TypeName System.Text.UTF8Encoding
    $hash = [System.BitConverter]::ToString($md5.ComputeHash($utf8.GetBytes($str)))
    return $hash.Replace('-', '').ToLower()
}

function toggleWifi {
    $page = (Invoke-WebRequest $wifiUrl).content
    
    $page -match 'name="nonce" value="(\w+)"'
    $nonce = $Matches[1] # why does powershell make everything hard...
    
    if ($page -match 'id="hashpassword"') {
        $hashpass = hex_md5 "$deviceCode$nonce"
        $form = @{nonce=$nonce; hashpassword=$hashpass; password=$('*' * $deviceCode.Length)} # let's see if password is necceasry 
        Invoke-WebRequest $wifiUrl -Method Post -Body $form -ContentType 'application/x-www-form-urlencoded'
    }
}

wifi-toggle.sh

#!/bin/bash
# wifi toggle (shell script version)

wifiUrl='http://192.168.1.254/cgi-bin/wmacauth.ha'
deviceCode=';)' # in plaint sight... ah well

md5str() {
	# notes for newbies (me):
	# -d is delimiter to cut by, -f is the field (index)
	printf "%s" "$1" | md5sum | cut -f 1 -d ' '
}

extractNonce() {
	# -o means only the match, not the surrounding context
	echo "$1" | grep -Eo 'name="nonce" value="(\w+)"' | 
	tr -d '"' | tr ' ' '=' | cut -d '=' -f 4
}

toggle_wifi() {
	local page=$(curl $wifiUrl)
	local nonce=$(extractNonce "$page")
	
	local isLoggedOut=$(echo "$page" | grep -o 'id="hashpassword"')
	if [ "$isLoggedOut" ]; then
		local hashpass=$(md5str "$deviceCode$nonce")
		local password=$(echo "$deviceCode" | tr -c '\0' '*')
	fi
}

the powerscript version is mostly for reference.
also, neither version is working yet, obviously

Fun fact: if you login to the BGW210 from your network, any client on the network now can access the modem for some period of time. Also, until that timeout hits, anytime a client checks a page that requires auth, the timeout changes.

Example: Login from your desk, then attempt to cURL the admin page(s) from a VM or a server. Then, setup a crontab to run every minute and hit the page, and it will never ask for auth. :)

That said, I need to work this out in python so I can reboot our modem - let me know if you get some basic proof of concept on a login session (preferably in bash or python). :) If you get it working in power shell I may be able to help on the other two.