Metasploit Framework

Also, it might do to revisit #445

This doesn't make sense to me; if the second-stage host is wrong (what you enter in multi/handler), then just set it to the correct value by hand. If the payload can still connect to its hardcoded first-stage LHOST, then there is no reason you can't set the second-stage name to match this in multi/handler. Adding an override is easy for the second stage, but I am not sure this makes sense given the above.

Here is the scenario:

Victim 1 -> 443 -> Attacker

Victim 2 isn't allowed to touch the internet but is allowed to touch other hosts
Attacker is using the single point of entry his IP/443 for other hosts during a phish and doesn't want to jeopardize other possible shells by dropping the multi/handler (not for too long at least)
Attacker uses netcat to forward 443 on Victim 1 to Attacker:443
Attacker generates a meterpreter payload the points at Victim 1:443

initial connection goes Victim 2 -> 443 -> Victim 1 -> 443 -> Attacker
handler picks it up and passes back the Attacker's IP to connect to
Victim 2 can't connect straight to it and drops the connection.

Granted it's a pretty corner case, but there are pretty cool implications of what could be accomplished with the option to set a fake LHOST based on the tag of a binary