Automatic LPORT selection

[dwelch-r7]

Summary

This came out of a discussion here #21581 (comment) as part of the smb_to_meterpreter work.
The default port for handlers is 4444 so it's likely to have that port not be available when doing something like a session upgrade, the idea is that we would add some logic to search for an available port when the default isn't available.

Few questions still to answer here though:

1. If a user sets a port and it's in use do we still want to attempt other ports? or do we fail if the port was set explicitly?
2. Where should it be used? obvious example are the shell/smb/etc to_meterpreter upgrades, should it extend to other modules? or does it only make sense in cases like sessions -u -1 where we can't directly set the datastore option?

[smcintyre-r7]

the idea is that we would add some logic to search for an available port

Binding to port 0 is standard across distributions AFAIK for asking the operating system to do exactly this. It's already exposed through Rex::Socket too:

[1] pry(#<Msf::Modules::Exploit__Windows__Smb__Psexec::MetasploitModule>)> sock = Rex::Socket::TcpServer.create('Server' => true, 'LocalHost' => '127.0.0.1', 'LocalPort' => 0)
=> #<Socket:fd 12>
[2] pry(#<Msf::Modules::Exploit__Windows__Smb__Psexec::MetasploitModule>)> sock.local_address.ip_port
=> 33887
[3] pry(#<Msf::Modules::Exploit__Windows__Smb__Psexec::MetasploitModule>)>

The behavior is even validated in our socket channel tests for pivoted sockets. Having said that, the local test I did above looks like a behavioral discrepancy but if we aligned that on what it should do (update #localport), we'd have exactly what you're looking for. It'd typically be a high port, but I think that's fine.

If a user sets a port and it's in use do we still want to attempt other ports? or do we fail if the port was set explicitly?

If a user specifies a port we should try to bind to it and fail if we're unable to do so. Failing and then changing it would make things more difficult to troubleshoot if the user doesn't realize that we decided to use a different value.

[smcintyre-r7]

Should land rapid7/rex-socket#87 as a pre-req so we can just get the OS-assigned port even from the local comm.