Make payloads Undetected

[rezass]

first of all i know there is not any fast one click-y way to do this(if there is in a few days AVs will detect it)
i want to learn basics of process of making payloads undetected.
is there any good references for it?
what exactly should do?
what in assembly code of exe file we should change to make it undetected?
placing push ax pop ax in random palaces will make it undetected?

[spudgunman]

there are great references for it... here are some keywords to assist in your research (aka google)

metasploit obfuscate payload
encoded payload metasploit

also some videos here
Metasploit Class Videos* (Hacking Illustrated Series InfoSec Tutorial Videos)

[lupin]

Id probably start by learning how virus scanners work. One very common technique is based on detecting file signatures, although other methods are used as well.

There is a bit of a discussion on signature avoidance in executables here, using Windows netcat as an example, with links to more stuff as well:
The Grey Corner: Bypassing Antivirus Detection: Netcat

For signature avoidance in other file types, you may want to look at this discussing how to avoid AV detection in malicious PDFs:
The Grey Corner: Bypassing AntiVirus Detection for Malicious PDFs

[rezass]

Id probably start by learning how virus scanners work. One very common technique is based on detecting file signatures, although other methods are used as well.

There is a bit of a discussion on signature avoidance in executables here, using Windows netcat as an example, with links to more stuff as well:
The Grey Corner: Bypassing Antivirus Detection: Netcat

For signature avoidance in other file types, you may want to look at this discussing how to avoid AV detection in malicious PDFs:
The Grey Corner: Bypassing AntiVirus Detection for Malicious PDFs

thanks for links i read them but example of changing binary code of netcat was very simple!
i want to make meterpreter undetected and that simple binary change wont work for that.
i'm trying to change binary code of program(found where nod32 looks for sig) but changing it won't make it undetected!
is there any other way to make meterpreter undetected?
or other more professional guide to change binary code?
another problem is there is not enough space to write my own codes in binary code(a few NOPs to write code in them)

[lupin]

thanks for links i read them but example of changing binary code of netcat was very simple!
i want to make meterpreter undetected and that simple binary change wont work for that.

The point of providing those links wasnt to give you a how to guide to bypassing AV, it was meant to help you understand one of the methods of AV detection (the simplest), because I recommended in the first sentence of my post that you learn how virus scanners work. Additional required research was left to the reader...

i'm trying to change binary code of program(found where nod32 looks for sig) but changing it won't make it undetected!

That means either:

• What you found wasnt actually the signature (or the ONLY signature) in the file,
• You didnt change the signature enough, or
• Some other means of detection is being employed. Have a look here as a starting point.