[drxddock]

Any port that isn't already heavily used by your computer or client could be used to listen for an incoming connection. You could even use ports like the http-alt port (8080). You don't have to listen for metasploit connections explicitly on port 4444, you can configure metasploit to any port you'd like. I'm sure there has to be at least one free port.

On top of that, if you REALLY need to use a specific port that's blocked from the outside, no problem! Use socat to listen on a port that isn't blocked on the outside, and fork that traffic to the port you need locally. (listen on [lan ip]:[port not blocked], fork traffic to localhost:[port needed])