http://www.metasploit.com/opcode_search.html

I need to find the offset for WinNT SP6, which DLL do the RPC DCOM exploits use?

I know that the messenger exploit uses user32.dll and i can easily extract the offsets using Ollydbg

TIA

Nevermind, I found out myself.

Open svchost.exe in Ollydbg, ALT+E, open ntdll.dll, CTRL+F, search for CALL EBX
Done.

hey you guys have any links to learn exploit writting ?

w00w00 rulezzz !!!
u own man tks for this url !!
this is a super tight link !!

Uhm...I'd figure most ISP's block common dcom related ports by now!
if you want a sweet ass exploit text,
Buffer overflows explained
covers heaps. but for ELF binaries, although the techniques are gold