What is worth talking about is the payload Greg designed for this exploit. So, the rest of the discussion is about the payload. One of the most common things a payload does is open a remote shell. Gee, all of the 'shell' based overflow attacks have been demoted to ankle-biters. We are going to attack the NT registry through functions already loaded into the process space.
Most processes have useful functions already loaded into address space.
In order to prevent NULL characters, I XOR my data area with 0x80. You could easily alter this to add a user to the system, or share a drive. Once this runs, check your registry and you'll find the value in question. The value will be executed upon the next reboot. This is a very common way for network worms to operate, incidentally.