Use %TEMP% environment variable as temporary directory (--tmp-path overwrites this btw) folder with direct connection (-d). Via SQL injection, env variables do not work apparently

bdamele · bdamele · commit f55ad4611995 · 2012-02-20T11:06:55.000Z
diff --git a/plugins/generic/misc.py b/plugins/generic/misc.py
@@ -39,14 +39,17 @@ def __init__(self):
     def getRemoteTempPath(self):
         if not conf.tmpPath:
             if Backend.isOs(OS.WINDOWS):
-                self.checkDbmsOs(detailed=True)
-
-                if Backend.getOsVersion() in ("2000", "NT"):
-                    conf.tmpPath = "C:/WINNT/Temp"
-                elif Backend.getOsVersion() in ("2003", "XP"):
-                    conf.tmpPath = "C:/Documents and Settings/All Users/Application Data/TEMP"
+                if conf.direct:
+                    conf.tmpPath = "%TEMP%"
                 else:
-                    conf.tmpPath = "C:/Users/All Users/Application Data/TEMP"
+                    self.checkDbmsOs(detailed=True)
+
+                    if Backend.getOsVersion() in ("2000", "NT"):
+                        conf.tmpPath = "C:/WINNT/Temp"
+                    elif Backend.getOsVersion() in ("2003", "XP"):
+                        conf.tmpPath = "C:/Documents and Settings/All Users/Application Data/TEMP"
+                    else:
+                        conf.tmpPath = "C:/Users/All Users/Application Data/TEMP"
             else:
                 conf.tmpPath = "/tmp"
 
