Why don't you use a system backdoor or bufferoverflow attacks to bind a shell to a higher port or you can install code that allows your commands to be "tunnelled" through the firewall using source routed packets or ICMP commands
(OF COURSE IT HAS vulnerabilities)
