Here you can find a PoC for MS05-011:

works against Win2k and is based on a captured session on my lokal network

http://www.livejournal.com/users/cybertronic/ 

-cybertronic