Hi,
Yes BAT is only available on the publisher. I've not tried in CUCM 5.1 but in newer versions you can execute SQL commands from the CLI via SSH, this will give you the phones and associated DNs for example:
run sql select a.name, a.description, c.dnorpattern, d.name as devicetype from devicenumplanmap b INNER JOIN device a ON b.fkdevice = a.pkid JOIN numplan c ON b.fknumplan = c.pkid JOIN typemodel d ON a.tkmodel = d.enum where a.name LIKE 'SEP%'
That's only really scratching the surface of what's in the database and you'll likely need more than that to rebuild your cluster, but it's a start. I can't take credit for the above, there are some excellent blogs out there with more information and examples, eg:
http://wiklunds.wordpress.com/2012/03/21/find-registered-phones-phone-details-and-database-replication-status-via-cli/
http://www.ucguerrilla.com/search/label/CUCM%20SQL%20Query
http://www.netcraftsmen.net/component/content/article/70-unified-communications/715-running-sql-queries-on-cucm-6x7x-using-axl-soap-toolkit-part-1.html
Another option if you have the time and spare hardware would be to back up the existing server (which you can do from CLI) and restore to a fresh install of CUCM 5.1, that may restore web admin access.
Also you could get root access to the appliance and get to the database directly, as a last (unsupported by TAC) resort.
Regards,
Jonathan