Here you can find a PoC for MS05-011: works against Win2k and is based on a captured session on my lokal network http://www.livejournal.com/users/cybertronic/ -cybertronic