Bathroom Ceiling Fan Installation

Without running an additional switched hot lead, it can be done using radio frequency transmitting switches which control a RF receiver/relay which you would have to wire into the ceiling box. Leviton makes devices like that. They are neither simple nor cheap. In my opinion it would be easier, quicker, and cheaper to fish a new wire or even open the wall. Patching is painstaking and tedious but not difficult.

Looks like you have a switch for a ceiling or vanity light and that there was probably a double switch for the fan and its light. If that's the case, here's how it goes. I'd strip everything out and start with fresh ends. There should be no tape involved--just properly-sized nuts. Yellow, red, and/or multi-size tan should do.

• The cable coming in at center appears to be your source. If that's not true, it's almost certainly the other two-wire cable. You'll need to safely investigate this.
• Source black needs two pigtails attached. One goes to the single switch (shown in your photo), and the other goes to your new double switch.
• Black from your ceiling/vanity light goes to the single switch (shown in your photo). Position of the two blacks is not important for this switch.
• Black and red from your fan go to the new double switch. Positions of the two blacks and the red depend on your choice of switch.
• All whites get bundled. No pigtails.
• All grounds get bundled, with pigtails to each switch (assuming modern switches with ground screws or pigtails).

Your situation essentially looks like this, though you'd have an additional wire coming off the timer switch:

Note that currently you have three blacks connected to the single switch, one presumably using the backstab socket. In my recipe I'm substituting a pigtail, which I think is a cleaner arrangement.

My condolences on the hideous hack-job done to your drywall.