Bind Shell
Bind shell. The shellcode calls socket(), bind() to some port, listen(), and accept() — opening a brand new TCP listener on the compromised machine, nothing to do with port 80. Once a connection comes in, it duplicates that socket onto file descriptors 0/1/2 and then execves /bin/sh. The attacker's one HTTP request was purely the trigger — after it fires, they just nc <target-ip> <chosen-port> with an ordinary netcat client, and that raw TCP connection is the interactive session. HTTP is out of the picture entirely from that point on.