How are RCEs operated if it is known that the shell is located in an internal network from which there is no access to the Internet?

Question

Computer networks

There is an RCE with which an attacker installed a payload on a machine in a gray grid from which there is no access to the Internet
. How can he get feedback from the payload?
What are the techniques for this?

Answer 1

from which there is no access to the Internet

Either not, or there is access.

Answer 2

No access how? Physically (the wire is cut off, torn off, there is no network card) or are the rules of the router spelled out like that?
Physical - only physical access.
If disabled due to router blocking, then the hacking logic is simple.
Access to the router through the console, registered a new user, and under the new user created a new routing rule. I studied until the server into which the wire was plugged ... It makes no sense to describe the process further.