With metasploit it is possible to open a reverse shell via meterpreter. For this you need to place a payload on the attacked server. E.g., there is an endpoint open that places files on a server, and you add the payload. I suppose this payload needs to be executed to work, how can this be done?
There are various ways to make a target machine execute code. Most of them exploit some sort of code injection or remote file inclusion, based on unfiltered user input (most of the time).
Assume the following file upload service:
A service provides
example.com/upload_file.php to allow users to upload files. There is no check in place and uploaded files are stored in
example.com/uploads as you can tell by uploads done in the past. You upload
evil.php containing your malicious code and it is placed in
Usually, a user would expect to be able to download the file but here it is different. The server executes this PHP-file as PHP is installed. Using this, you may make a server execute arbitrary code. The error lies in the server not filtering user input and blindly allowing files to be uploaded, which may be executables.
This is just one (very simple) technique. Others may exploit SQL-/Code-Injections like this one:
A website allows you to enter an IP and the server executes
ping on this IP. Your input may be something like
126.96.36.199, which is fine.
188.8.131.52NotAnIP may be less fine, but
127.0.0.1;rm -rf ~, resulting in
ping 184.108.40.206;rm -rf ~ being executed on the server, will certainly be devastating in some cases.
You question is really broad, as there are many (creative) ways to make remote machines execute code, but I hope this provided some hints and ideas.