Ingredients:

Latest version of Hijack (I'm using v355)
empeg-preinit
EmpTelnetd

I'll leave installing Hijack and empeg-preinit as an exercise for the reader (and also because the instructions on those sites are quite clear as-is).

One caveat: For empeg-preinit, I didn't create /programs0 and /programs1 (seeing how that requires you be at the shell prompt, which is what we're trying to do here to begin with).

EmpTelnetd comes with a "devs" script that sets up a bunch-a new nodes in /dev. I edited devs so it runs "rw" right before all the mknod lines and also "ro" at the very end. Next, I changed its name to M20devs, placed it in /etc/preinit.d (plus a chmod 755), then I also placed telnetd into /bin (again, chmod 755), and rebooted. This should run M20devs after the drives are mounted.

After the reboot, I went back in with ftp and checked /dev. Sure enough, there were all the new nodes! I now removed M20devs, created a new file N75telnetd (containing one line: /bin/telnetd) and placed it into /etc/preinit.d (again don't forget chmod 755). Another reboot, and I can now telnet to the empeg. Nice.

What next? Well, I'm not too keen on telnetd living in /bin. (Remember /programs0 and /programs1? Yes, that would be much better.) Another exercise for the reader.