Hi I after scanning many machines the most frequent exploits are
OpenSSH 3.7.0 Buffer Overflow and
on IIS Web Servers: TCP:80 - Malformed HTR Request - NT4(another buffer overflow).
Are these worthless? Most require write access..

Yeah way back when rpc 1 came out I was doing large scans, like 68.0-10.0-255.2-254. On may cable connection it took about 7-8 hours. Damn, good times, we defiantly need another major vulnerability in winblowz. Now that nmap has the random scan function I really want a new vulnerability.
If you are looking for ports to scan check out:

http://isc.incidents.org/

Now not all of toughs are people looking for vulnerability. Edoneky for example, that caused by how Edonkey the program works. Do some research into the port, check out google, then compile some exploit code and start your scanning.

You really need to use an auto hacker, I just threw one together with perl. I found if I did a 7-8 hour scan while I was in class, the computers would often be down when I came back to them.

peace out

(p.s. sory for the double post)

whell SSH ain't bad but it is hard to hack cause it is linux.
in my opinion you should try to hacking dameware.