Looking for pointers in the right direction, have seen multiple examples of exploit code allowing shell connections on ANY 'in-use' port, while the original application on that port continues to function without issue.
I am interested from a programmatic/system level view how this is achieved.
I ask here in desperation as all I have come up with is tcpmux (which uses TCP#1 and would break existing applications on the port as a service name needs to be sent by each client before the specified application responds).
Best way I can describe it is port knocking with a fallback scenario should the knock fail to the original application listening on the port.
My google-foo seems weak on this one. Also, I've only seen this on windows hosts, would like to further my research to see if the same is possible on Linux systems.