What is the connection between an exploit to the point of privelage escalation and opening a reverse shell?

I understand certain parts of the process but not how they are tied together.

E.g. If an vulnerability is found and an overflow exploited with some payload that includes a NOP sled down to the executing payload, how is it connected to actually get root on the system or to copy the code to VM and change the memory section to executable?

Do additional payloads need to be sent through the same overflow? What is the actual controller that pieces the components together?

And for the reverse shell, is that an encrypted socket back to some system so that the C&C packets can be sent? I'm still missing what actually takes control on the remote system to handle this? Can a full program be injected in the overflow or in pieces and somehow reassembled and start running?