From 95998e3989565d7adfeadb14f0777587b863f938 Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Wed, 30 Jan 2013 14:38:21 +0100
Subject: [PATCH] Implementing undocumented way how to retrieve w+ temporary
 directory name on MsSQL (suggested by Vlado Velichkovski)

---
 plugins/generic/misc.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/plugins/generic/misc.py b/plugins/generic/misc.py
index 9ab4adb7d..5fe7fa111 100644
--- a/plugins/generic/misc.py
+++ b/plugins/generic/misc.py
@@ -5,6 +5,7 @@ Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
 See the file 'doc/COPYING' for copying permission
 """
 
+import ntpath
 import re
 
 from lib.core.common import Backend
@@ -36,6 +37,11 @@ class Miscellaneous:
         pass
 
     def getRemoteTempPath(self):
+        if not conf.tmpPath and Backend.isDbms(DBMS.MSSQL):
+            _ = unArrayizeValue(inject.getValue("SELECT SERVERPROPERTY('ErrorLogFileName')", safeCharEncode=False))
+            if _:
+                conf.tmpPath = ntpath.dirname(_)
+
         if not conf.tmpPath:
             if Backend.isOs(OS.WINDOWS):
                 if conf.direct: