anyone know of any reverse connection trojans with tcp tunneling besides nuclear rat?

do you mean like a Loki trojan where the trojan hides its command within some regualr packet ex. icmp echo ?? search in phrack for loki .

nc perhaps