All GSM modems that I know of have two modes: command and data. And that includes the SIM900. The modem starts out in command mode, where it is listening for AT commands, typically over a serial UART connection with a microcontroller.
AT commands are patterned after the Hayes telephone modems of the 1980s and 90s. AT stands for Attention. They are used to both set up the parameters for the connection, and then initiate the connection itself, in the case of the SIM900 this is done with the AT+CIPSTART command. If the connection is successful, the modem responds CONNECT OK and switches to data mode.
At that point a binary data connection is established between the GSM modem and a far-end socket. Bytes can be sent back and forth transparently. The modem can only be changed back into command mode if any one of the three things happen: the +++ escape sequence (patented by Hayes) is sent from the local microcontroller, or the DTR lead is turned off (only if it has been configured to act this way), or the connection is dropped.
Only in the first case (+++ escape sequence) is the connection still held up. However while the modem is in command sequence, it can't "see" the far end anymore.
So what you wanted to do, i.e. send AT commands from the far end and have the modem execute them, is impossible because the modem only listens for commands from its local microcontroller and only when it is in command mode. Even if you were to send AT commands over the link in data mode, the GSM modem would just forward them on to the microcontroller it is attached to.
It would be possible to indirectly execute AT commands from the far end with assistance from the local microcontroller. The far end would send the AT command(s) over the link in data mode, and the local microcontroller would queue them up. The far end would need to have some way to tell the local microcontroller when it was done and should start executing commands. At that time, the microcontroller would send the +++ escape sequence, and then send the queued AT commands. When it was done, it would return to data mode using the ATO command, and perhaps send the results of the commands back to the far end.