Service packs are groups of patches released in a lump sum. You have to set the service pack for some exploits because depending on which service pack, the sec hole might differ. As for finding out which SP is installed, trial and error is the only way without access to a shell, which you probably dont have and is why you are exploiting it.

Not entirely correct..

Try this nice little fingerprinting tool "Xprobe"

http://www.sys-security.com/html/projects/X.html

This will give you a good indication of the OS and SP used...

Enjoy

Output:

[+] Target is 192.168.1.200
[+] Loading modules.
[+] Following modules are loaded:
[x]ICMP echo (ping)
[x]TTL distance [x]ICMP echo
[x]ICMP Timestamp [x]ICMP Address [x]ICMP Info Request [x]ICMP port unreachable [+] 7 modules registered [+] Initializing scan engine [+] Running scan engine [+] Host: 192.168.1.200 is up (Guess probability: 100%) [+] Target: 192.168.1.200 is alive [+] Primary guess:
[+] Host 192.168.1.200 Running OS: "Microsoft Windows 2000/2000SP1/2000SP2" (Guess probability: 68%)
[+] Other guesses:
[+] Host 192.168.1.200 Running OS: "Microsoft Windows XP Professional" (Guess probability: 68%) [+] Host 192.168.1.200 Running OS: "Microsoft Windows ME" (Guess probability: 63%) [+] Host 192.168.1.200 Running OS: "Microsoft Windows NT 4 Service Pack 4 and Above" (Guess probability: 59%) [+] Host 192.168.1.200 Running OS: "NetBSD 1.5.2" (Guess probability: 59%)
[+] Cleaning up scan engine [+] Modules deinitialized [+] Execution completed. carman:~/tmp/xprobe2/src #