Something like this through the FTP server?

site exec df -a


[EDIT] Mmmm.. no, not quite. The Hijack "SITE EXEC" doesn't capture/return stdout. But using the built-in telnet server makes it easier:

telnet yeller
Trying 10.0.0.37...
Connected to yeller.localnet.
Escape character is '^]'.
bash: no job control in this shell
empeg:/# df /drive0
df /drive0
df: Warning: cannot read table of mounted filesystems: No such file or directory
Filesystem 1k-blocks Used Available Use% Mounted on
- 29181695 23860788 5320907 82% /drive0
empeg:/# exit