How can I simulate a ssh session on a client behind a NAT?

Question

Quick question:

How can I simulate a ssh session, that I can use to run commands on a client behind a NAT, that uses only program installed by default on most operating systems (telnet...).

Long version:

I got this problem from this story: a friend of mine got her linux broken. She wasn't able to install anything, and I wanted to run commands on her computer to solve the problem (it's really not practical to say "type this", "what is written ?", "ok, now type this"...). The thing is that she does not have open-ssh-server installed, and she is behind a NAT proxy. Hopefully, I have a server with a public ip.

So I came out with this first solution. On the server side, I run (nc is also named netcat sometimes):

nc -l -p 23456

and on the client side, I run these commands to create a double pipe between netcat and bash. NB : I could use telnet instead of netcat here if netcat is not installed:

mkfifo fifo0
nc <server ip> 23456 < fifo0 | sh > fifo0

Then, I just need to type the commands on the server, and I get the answer directly. However, it does not work well with complex applications such as vim/emacs/screen that needs to run inside a tty. I though that I could use socat to deal with that, but actually I don't really understand how the tty works (I cannot even link a bash session to a tty)... So here is my question: how could I improve (or change) what I did, in order to provide also a working session for application that needs to run in a tty ? I also would like to use the most basic applications as possible, I want to use only the application installed by default on most operating system (debian and ubuntu for example).

EDIT 1 I found a first solution. For now it has one problem: it does not handle the Ctrl-... keys (I need to find a way not to escape these chars I guess), and it needs socat installed (which is not installed by default):

on the server:

socat READLINE,history=/tmp/my_history TCP-LISTEN:23456

on the client:

socat PTY,link=/tmp/socat.pty TCP:185.107.80.185:23456 &
sleep 1 && ( setsid bash ) </tmp/socat.pty >/tmp/socat.pty 2>&1

EDIT 2 I found a way to avoid the problem of Ctrl-... keys, by logging using screen (works also with minicom...) on the server. It still has the problem of needing socat installed on the client machine. Here are all the commands:

On the server:

socat PTY,link=/tmp/socat.pty TCP-LISTEN:<server port> &
screen /tmp/socat.pty

on the client:

socat PTY,link=/tmp/socat.pty TCP:<server ip>:<server port>
sleep 1 && ( setsid bash ) </tmp/socat.pty >/tmp/socat.pty 2>&1

Now, I'm curious if it's possible to do the same thing with just telnet installed.