How to download restricted backup config file on HG8245H router

Question

I have HG8245H router and I want to download backup config file to which I dont have access as regular user in my case its caled root. So I downloaded firmware of my router and extracted it using binwalk and found .asp files in particlar cfgfile.asp and cfgfileroot.asp. Cfgfile.asp contain this snippet of java code below which is missing in page from where I should download configs so I opened `Inspect Elements in Firefox and add it in side java tags

function backupSetting() {
 
    var Form = new webSubmitForm();
    Form.setAction('cfgfiledown.cgi?&RequestFile=html/management/cfgfile.asp');
    Form.addParameter('x.X_HW_Token', getValue('onttoken'));
    Form.submit();
}

Also cfgfileroot.asp had missing html code so I added that to after regular code

  <table width="100%" height="5" border="0" cellpadding="0" cellspacing="0"> 
    <tr> 
      <td> </td> 
    </tr> 
  </table> 
  <table width="100%" cellpadding="0" cellspacing="0"> 
    <tr> 
      <td> <input style="width:150px" class="submit" name="saveconfigbutton" id="saveconfigbutton" type='button' onClick='SaveSetting()' BindText="s0709"> </td> 
      <td> <input style="width:150px" class="submit" name="btnsaveandreboot" id="btnsaveandreboot" type='button' onClick='SaveandReboot()' BindText="s070a"> </td> 
    </tr> 
  </table> 
</div> 
<table width="100%" height="18" border="0" cellpadding="0" cellspacing="0"> 
  <tr> 
    <td> </td> 
  </tr> 
</table> 
<script language="JavaScript" type="text/javascript">
    if(curUserType != sysUserType)
    {
        document.write('<div id="downloadConfig" style="display:none"> ');
    }
    else
    {
        document.write('<div id="downloadConfig"> ');
    }
</script>

  <table width="100%" border="0" cellspacing="0" cellpadding="0"> 
    <tr> 
      <td class="prompt"> 
        <table width="100%" border="0" cellspacing="0" cellpadding="0"> 
          <tr> 
            <td class="title_common" BindText="s070b"></td> 
          </tr> 
        </table>
      </td> 
    </tr> 
  </table> 
  <table width="100%" height="5" border="0" cellpadding="0" cellspacing="0"> 
    <tr> 
      <td> </td> 
    </tr> 
  </table> 
  <table width="100%" cellpadding="0" cellspacing="0"> 
    <tr> 
      <td> 
        <input class="submit" style="width:220px" name="downloadconfigbutton" id="downloadconfigbutton" type='button' onClick='backupSetting()' BindText="s070c" >
      </td> 
    </tr> 
  </table> 
</div> 
<form action="cfgfileupload.cgi?RequestFile=html/management/reset.asp&FileType=config&RequestToken=<%HW_WEB_GetToken();%>" method="post" enctype="multipart/form-data" name="fr_uploadSetting" id="fr_uploadSetting"> 
  
<script language="JavaScript" type="text/javascript">
    if(curUserType != sysUserType)
    {
        document.write('<div id="uploadConfig" style="display:none">');
    }
    else
    {
        document.write('<div id="uploadConfig">');
    }
</script>

    <table width="100%" height="10%" border="0" cellspacing="0" cellpadding="0"> 
      <tr> 
        <td class="prompt"> 
          <table width="100%" border="0" cellspacing="0" cellpadding="0"> 
            <tr> 
              <td class="title_common" BindText="s070d"></td> 
            </tr> 
          </table>
        </td> 
      </tr> 
    </table> 
    <table width="100%" height="5" border="0" cellpadding="0" cellspacing="0"> 
      <tr> 
        <td> </td> 
      </tr> 
    </table> 
    <table> 
      <tr> 
        <td BindText="s070e"></td> 
        <td> 
            <div class="filewrap"> 
            <div class="fileupload"> 
              <input type="hidden" name="onttoken" id="hwonttoken" value="<%HW_WEB_GetToken();%>"> 
              <input type="text" id="f_file" autocomplete="off" readonly="readonly" /> 
              <input type="file" name="browse" id="t_file" size="1"  onblur="StartFileOpt();" onchange="fchange();" /> 
              <input id="btnBrowse" type="button" class="submit" BindText="s070f" /> 
            </div> 
            </div>
        </td> 
        <td> <input class="submit" name="btnSubmit" id="btnSubmit" type='button' onclick='uploadSetting();' BindText="s0710" /> </td> 
      </tr> 
    </table> 
  </div> 
</form> 

<script>
var all = document.getElementsByTagName("td");
for (var i = 0; i < all.length; i++)
{
    var b = all[i];
    var c = b.getAttribute("BindText");
    if(c == null)
    {
        continue;
    }
    b.innerHTML = ssmpLanguage[c];
}

var all = document.getElementsByTagName("input");
for (var i = 0; i < all.length; i++)
{
    var b = all[i];
    var c = b.getAttribute("BindText");
    if(c == null)
    {
        continue;
    }
    b.value = ssmpLanguage[c];
}
</script>

Here is how it look's modified

After that I gone from this page displayed below

to

But when I click Downlod configuration file nothing happens :(

If you have HG8245 or HG8245H plese log in as in my case telecomadmin or user with wich you can access to backup config and send me content of https://192.168.100.1:80/html/managment/cfgfileroot.asp that page