The main difference between you running the script from a telnet (or serial) connection, is that there will be an "attached terminal", and stdin will point at it.

When running from Hijack (either from FTP or MENUEXEC or the other Hijack mechanisms), Hijack explicitly points stdin at /dev/null to prevent the program locking up trying to read from standard input. It does, however, attempt to point both stdout and stderr at /dev/consle (the serial port). The filesystem, session, signal handling, and other process attributes are all set to be those of init (the root of all processes).

I'm betting your rexec woes have something to do with stdin. You should hook up a serial cable and watch for error messages on the serial console, while running the script remotely from FTP (over ethernet) or whatever.

Cheers