Although nmap's OS-detection ability can be thrown off by packet filters and firewalls, it's a powerful tool. They typically don't get the same attention as production machines, but they frequently have equivalent levels of access. It is running Microsoft Internet Information Server and wu-ftpd, among other services. This is where the Internet comes in handy. Both are usually the result of poor programming.
Local vulnerabilities are only exploitable after first gaining some level of authenticated access.
In the Unix world, this is often a login shell. Remotely exploitable holes can be any assortment of OS and service flaws that are accessible via the network. In this case, we do not have any preliminary access, so we're forced to stick with remote exploits. For this network we identified Microsoft IIS version 4, and the development machines most likely have a fair amount of tools and database connectivity solutions. They'll identify the hole and move on.