There is a way to do EXEC over http -- I'll have to look it up later. But perhaps simpler than much of this is to use telnet rather than ftp ?

Hijack has a telnet server.