how to remotely fingerprint 2k3 SP0 vs SP1 ?

["Hamid . K" <elite_netbios () yahoo com>]

Hi ,
During an intrusion ( legal btw ! ) I made a nasty
mistake , and used a code wich was optimized for 2k3
sp0
how ever real target was running sp1 and resault is
obvious.  complete crash of remote service and no more
stealth intrusion :-/

considering usual ports open, such az some RPC staff
and other usual servuces like IIS and etc, is there
anyway to
remotely guess SP version of running host ?


// Let`s skip universal return addresses , ok ? :>

regards
Hamid


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave