Is it possible to compose an attack vector in such a way that a remote victim will not be required initially to interact with an attacker? That is, if OS is vulnerable then you'll execute the vulnerability successfully without victim perception.
So far in the blogs, articles that I've read, they usually suggest that you create a bait (PDF, Flash Player, etc) then abet the victim to trigger it, but the real life scenario may not work like that.
Enticing someone to click a link or to download a crafted vulnerable file may sound suspicious and shrewd end - user may immediately stop interacting. Aside from all that you will use your credibility.