Hello folks, we'll begin in a minute. We're just waiting for people to zoom in. Well, welcome everybody. I am George Bacille. I am the associate director for the Global Kitechee Center here at ASU and also a professor in the School of Sustainability. We're very excited to have everybody here and to have our inaugural lecture for the Global Kitechee Center. Professor Stratos, we were talking about Professor Stratos Pistocopoulos, we'll hear more about in a second. The Global Kitechee Center is a partnership between ASU's Global Future Laboratories and the Kitechee Institute, which is part of the Mitsubishi Chemical Holdings Group over in Japan. And we really focus on bringing health and wellness and sustainability to society with a great focus on circular economy and how we get there. And we're very excited to have Professor Pistocopoulos to talk about the circular economy in a sustainable engineering framework. Just a couple of housekeeping things you guys, we're on a webinar here. So you'll look down, you'll see the Q&A section below. That's where you can enter questions at any time for the professor. And after his talk, we'll have about 15 minutes or so to go over and address those things. So with that, I'd like to welcome George Stephanopoulos, Professor George Stephanopoulos, who is the founding director of the Global Kitechee Center to introduce both himself and our guest speaker. So George, with that over to you. I'm George Stephanopoulos, the director of the Global Kitechee Center at ASU, and I am truly delighted to introduce today to you our special guest. Professor Stratos Pistocopoulos is the director of the Energy Institute at Texas A&M University, and holds the Dow Chemical Chair in the R&D Engineering Department of Chemical Engineering. He has a PhD in Chemical Engineering from Carnegie Mellon. He has authored and authored over 500 major research publications, 15 books, and he has four patterns in the areas of modeling, process control and optimization, energy systems, sustainability, circular economy and systems engineering applications. He is a co-founder of Process Systems Enterprise, a very creative company in Process Systems Engineering, which was so valuable that was recently acquired by Siemens. He is a fellow of the American Institute of Chemical Engineering and fellow of the UK Institute of Chemical Engineering, and he is the current editor in chief of Computers and Chemical Engineering, which is the premier journal in computing and chemical engineering. He has received many honors and awards. I would like to note among them that in 2007 he was a core recipient of the most prestigious Macroberts award from the Royal Academy of Engineering in the UK. In 2013 he was an elected fellow of the Royal Academy of Engineering in the UK, and in 2017 he received the US Computing in Chemical Engineering of the American Institute of Chemical Engineering, and last year he received the equivalent of the previous award in the UK. He is called the Sergeant Medal from the Institute of Chemical Engineering. So at this point without any further delay, here is Professor Pisticovlu, the title of his lecture is toward a circular economy systems engineering framework. George, thank you. I hope everybody can hear me well. Well, it's an honor for me to be taking part at this very distinguished seminar series of the Global Kaiteki Center, led by Professor George Stephanopoulos, one of the most inspirational and influential academic leaders and thinkers of our modern era. And George has been a mentor and a role model for me throughout my academic career. So this is a special, you know, place for me. So I would like to share with you some of my thoughts as we build towards what I will call a circular economy systems engineering framework. Before we start, I would like first to acknowledge the contributions of many bodies who have been working with us towards this from NSF, the, you know, Shell, the Center for Water and Talks, the various entities within Texas A&M. I will especially like to mention the School of Law and the Agricultural School that we're collaborating a lot. And my special thanks and a lot of the work I'm going to describe is due to my former PSD and current postdoc and the scientist at the Texas A&M Energy Institute, Dr. Siliana Abramidou. So just at a glance, my research group at the Texas A&M Energy Institute, and I would like to, you know, I'm the spoke person of the bright minds that work behind the, you know, behind the scenes towards our research. I will not resist the temptation to say a few words first about the Texas A&M Energy Institute, just to demonstrate the breadth and depth, you know, like the truly it's one of the beckons of through the disciplinarity within Texas A&M. The current focus of your wish is to discover energy solutions which improve quality of life, breaking together what I will call and that's a pillar for the thinking of the energy institute. This is systems-wide structure and approach in connecting technologies, both fossil and non-fossil, materials and agents, which are important for the energy solutions of the future, together with the societal drivers, economics, law, policies, sustainability and the glue that connects everything together, what we call the multi-scale energy systems engineering, that's the modeling, the data analysis, you know, the medium that connects materials to technologies and link them to objectives, societal-driven objectives. And we have a program that essentially looks at the landscape of the energy research, a strong program on education that I would like to touch upon in the next slide. And I would like just to highlight the truly in the disciplinarity nature, connecting more than close now to 300 faculty affiliates from all around the Texas A&M system, various cabuses and the major state agencies involved. Just at a glance, you know, one of the things that are, we're very proud that the energy institute is this master program that takes essentially instead of a breadth, a breadth depth kind of a depth-based type of look at the various energy aspects, it takes a breadth and let's look at it, you know, looking at the entire landscape of the various factors and key drivers in energy so that we look for instance for energy law, materials for energy, energy technologies, economics and finance, resilience and sustainability and energy desization, and we have both in-person and remote program both on certificate and matter of science with the view to develop the next generation of leaders who look at the various aspects of the energy research and development landscape through quantitative analytical methods. And the model we have is more like an engagement model, like a partnership-based type of initiatives. We participate and lead on behalf of the Texas A&M space or participate in major initiatives, nationwide initiatives like the US manufacturing institutes in rapid and cement manufacturing. This is led by SCHC, this is led by the UCLA, both are Department of Energy type of initiatives, we participate in the super fund program, we have the master program, we have a long-term partnership with CEL and other organizations and we're involved in a number of interdisciplinary activities across KABUS with various partners across the nation and across the globe. So let me go back to what I will try to do today, I will try a little bit to address the issues, how circular economy after defining, you know, see the various aspects of it, how it is linked to much more formal systems analysis and what can engineering and science can offer. Then I will talk a little bit about some of the scientific needs and challenges, what in many ways pose as formidable tasks for the future, and then present a holistic approach, what I will attain and, you know, name it as a circular economy systems engineering, so this is really a systems and engineering lens for addressing circular economy aspects. And that was the basis of, you know, a perspective article that we put forward recently, a year ago, and it was very much at the heart of the webinar that I gave a couple of months ago, on behalf of the sergeant metal prize that I received recently. So my favorite topic for those of you who know me is coffee, so I have been very privileged one of the institutes and centers I collaborate a lot at Texas A&M is with the Coffee Institute of Research and Education. So and for all of you who enjoy coffee, this is like an espresso, it's an excellent motivating example I think because if you look at it carefully, just a cup of coffee uses 140 liters of water, I'll come back to this, I was very surprised when I saw this actually, and quite a bit of energy. And at the same time produces quite a significant amount, five times the amount of CO2 in weight, plastic waste, a lot of dry waste and spent waste, right. At the same time, one has to consider the economics of coffee, you know, so this is, this is after all is a product that we do not, it is inedible yet, you know, if you look carefully and this is a 2016-17 type of figure, we're talking about only in the US over $70 billion type of industry around coffee. So let's have a more closer glance at the supply chain of coffee, so and why, you know, all these metrics are relevant. First of all, you know, coffee comes from a plantation, so you have nutrients that feed the coffee plantations, then you produce coffee berries, then those produce the beans and at that stage is when you export and you pack up the coffee, you use plastic usually for packaging, and then taking coffee to the consumers through supermarkets, and this is the espresso that we all enjoy. So if we look carefully now, what is happening, first of all, the one thing to note is waste is created literally at every stage of the process. At the plantation level, we have bad berries that never are processed any further. We have from the berries going to the coffee bean stage, we have a lot of coffee pulp, coffee husk and the silver scheme, so you know, so there is some separation from going from the berries to the beans. Then they might have also spillages and degradation when you try to go from beans to the packet states, you have plastic waste that generated, you might have expiration degradation and all the stages, all the way to the consumer. So that's one thing to keep in mind. The second important aspect and that's where water comes into play is that water is really used big time and contaminated at various stages of the process, especially for the plantation, then at the coffee beans level and obviously when we actually make coffee. So that's the flow of water. The other dimension is clearly energy and we need a lot of energy and it's essential at every stage of the way, typically coming from fossil fuels producing emissions obviously is used for the plantation level, and you can see plays an important role, all the way to the production of our beloved expression So, and that takes us to the question what is circular economy and what has to do with the coffee. So, if we look at the production from a coffee, you know, from an espresso looking backwards from an espresso production point of view, you can see that the production chain of coffee is clearly correspond corresponding to the linear economy type of model would like to produce coffee no matter what, we reproduce a number of other things in the way. So, and so what is then circular economy that kind of arrangement is first of all to use as much as possible renewable type of energy source substituting the fossil fuels. Try to use the usable packaging as much as possible in the at the early stages for the packets coffee and so forth. Collect waste and produce alternative products so we don't essentially anything that previously was deemed to be a ways to be sort of a sink towards the production of alternative products will come back to this later. And finally, try to return natural resources as much as possible to the source clearly when it comes to water and nutrients in particular. So, in that sense, we are abandoning with the linearity of the classical model that has been prevailing the production supply value chain towards the circular economy model, who are effectively tries to not only minimize the resource extraction, minimize the landfill waste by and doing this by reducing, repairing, remaking and recycling. So it reduces if you wish new pathways towards into the introduction looking at every waste as a source of potentially valuable new product line. But what is at least astonishing and what we have found out is that when it comes to definitions of what the circular economy. There is a quite variety of at least 114 definitions that was a, you know, a relatively recent paper conceptual you know doing an analysis of 114 definitions. And you can see definitions of circular economy about maintaining products as long as possible, minimizing waste and resource use, low consumption and energy and low emissions, the restorative and generative by design, nature, keep materials and use and so forth. So one of the things, one of the thesis of my presentation that one of the takeaway messages will come back to this a little bit lighter is that there is no consistent definition for circular economy, and there's desperately, especially we're trying to develop the science of circular economy, desperately there's a need of a scientific basis. Well, the key of course question is why bother you know why circular economy could become a driving force, both for science for engineering, and for economic economic aspects and sustainability. First of all is the border realization that most of the things we are dealing with either a big proportion of this is wasted, or is not used properly. This is an example of this point like almost 30% of the food is wasted. You know if you think about cars, you know we buy all these expensive cars which only we are using, you know 8% of the useful lifetime. Service, car as a service is gaining a lot of attention at the moment, offices, you know we witness through the COVID you know that you know even before we were using only approximately 40 to 50% of the time the office is now even less so the whole concept of effective use of space is coming. It's a quiz challenge if you wish, and then if you look at one of the most important challenges of the modern era, like what, what are we going to do with the existing plastic that exists and then how substitute, you know with by the gravel plastics that opens up new many new research And then if you look carefully like and here is a slides that just reiterate the importance of looking at both that resources and waste. So here is the per capita if you wish, tons and sort of annual growth of resources extraction in different categories from metal or fossil energy carriers biomass non metallic minerals, and you can see that we are over exhausting our resources at quite a considerable annual rate. At the same time, the total waste generated generation and the waste generation per capital keeps on increasing, while you know the recycling and composting rate you know it's around in 2017 has been at the modest below like around 36%. And there is a lot to be done towards this direction. If you look at from an energy perspective, you know, given that the world population is expected to go over 11 billion by 2100 and you know the energy consumption by a region is going to be increasing especially due to the booming of the Asian countries and so forth, and given the importance of, of energy, which saw the energy as part of the growth of the GDP. So the how we are dealing with the energy transition space in gradually introducing renewables to substitute in the scenarios of the future and I will come back to this in a sustainable promise and the circular economy perspective remains a key challenge for the modern era. So, on the one hand, we have this rising populations which put huge stresses on the resources and on the natural resources. We have increasingly ways, increasingly increased ways that have a negative impact on the environment. And circular economy, especially if we approach it in a holistic manner would definitely contribute to all dimensions of the system of development in terms of economics, environmental and social aspects, and perhaps it offers even a more consensus type of of term towards a more politically and socially accepted term, you know, avoiding if you wish debates about aspects like global warming and this. Obviously, circular economy now is gaining a lot of momentum driven, you know, here you can see just a sample of various initiatives, both at the national level at the new level you also a company level. And very much mostly promoted by governments and businesses around the world, and somewhat, you know, you know, there is a lack of, of a systematic science based approach circular economy that offers tremendous possibilities for growth in the future. So, and that's the second view is key method that would like to explore with you so what are the links of circular economy to engineering and science and to systems analysis. Is it perpendicular to things we have been doing so far, or it is, you know, can we can borrow concepts and create a new scientific basis based on solid foundations. So if you look now carefully, you know, at the various aspects. Now, on utilizing resources extraction and producing, you know, valuable products based on very valuable raw materials. That's where we wish green chemistry and the economy can play very important role here is an example that you only green chemistry. You don't need to go into the details just to see that here is one, but a root if you wish based on one particular chemical reaction that takes advantage of 81% of the atom economy so that in terms that relates to not so maximum resource. You need more resource use to accomplish the same production level where based on much more intelligent green type of chemistry, you can go all the way to 100% atom economy. So that minimizes resource use and minimizes as much as possible ways to the production state. So green chemistry is a very important pillar towards circular economy. If you look at the food then it's water nexus where you look now at the interactions of energy, water, which are natural resource and food which is an organic product in many ways. You know, you clearly need a holistic approach to minimize the stresses between the nexus, the nexus and it's a topic that I'll come into the moment. Pro-scientification is another way where you can guide the circular economy thinking and can be defined and it's such as any process development that can lead to substantially smaller, cleaner, safer and more efficient energy technologies. So for instance here is an example, one of the textbook materials now where you have a very complicated if you wish process involving 11 plus units we don't need to go into the detail this for the production of methyl acetate where you can do the same thing in a single unit, buying that can lead to over 70% reductions in cost energy and pollution. And that's if you wish, the key, you know, that has regained a lot of attention recently and rapid study this is the process education institute under the umbrella of a DOE and ACHC. So, and it's an opportunity that the process industry is exploring revisiting the concept of proscientification. There's a lot of ways to products, reverse supply chains and that's really also the symbiosis. This is an excellent exam where we can look at ways as a room as a useful raw material for other type of interconnecting networks. So here is an as this is the concept where you use the heat waste heat recovery so you use the excess of waste heat as a source. For other parts of the production chain, cogeneration and by product chain, and this is not, if you wish something that of it's like an attempt, a futuristic attempt, this is happening at the moment so there are exams where the symbiosis has really resulted in significant advantages in maximizing the benefits between energy flows, water flows and materials flows. And then you have all the other aspects like life cycle analysis, supply chain optimization, and what I would like to, you know, to connect what is the connectivity of all those aspects of the waste and often domain different domain drivers is that they cannot be analyzed to systems and they cannot be measured in rank and scientific type of approach. So let's look a little bit more closely now at some specific scientific needs and unique challenges that the circular economy may take us. There are certain aspects that I think is, you know, quite challenging for from a research coordination point of view is that you have interconnected when you're dealing with circular economy you are having interconnected players should have multiple stakeholders, different domain different pieces of legislation that may, you know, be applicable to different parts of the value chain, different policy aspects and so forth. For instance, if you can look it from a society point of view, the objectives might be totally different, you know, there might be common economic sustainability and environmental, but obviously, you know, the objectives and the means to implement those at different levels of the decision making value chain difference. And you can see here that different the connectivity between the societal drivers, the national governmental bodies and the network of interest and so this interconnectivity of different players with different objectives, different types of freedom, different pieces of implementation and different stakes at any given time, offer a unique challenge. The other important challenge, if you wish is the multi the inherent multi scale character of the problem it had because it's you need to look, you know, if you talk about atom economy, you need to look at the molecular level if you look at the water in the example of let's say of the food supply and so forth, you look at the plan and enterprise level so you need to look in tandem at the various scales in terms of length and time, and you have also if you look at operation will see later at the energy system where you look at the electricity demand obviously you look to you have to look even at the level of minutes even seconds, whereas the power generation happens at the level of hours and days. So this temporal and special spatial system boundaries play a role, you have different data which come and different instances of the data integration is an issue, model integration is an issue and so forth. The other important challenge is that there's a huge uncertainty in the system, you know, we're talking about reverse reaction pathways, there is variability in the system for demand, energy, solar and weight and so forth, costs, you know, there are my technologies that have not been developed fully so cost is a variable as well, resource availability, so there is a temporal also you know there is a variability in space because you don't have all the sources at the same place, location and time that you want, so all these aspects offer a very dynamic and uncertain environment that needs to be incorporated in such a holistic approach. And the final pillar if you wish of needs and challenges is the assessment criteria that you know you have on the one hand social economic drivers and you have environmental sustainability and you need somehow to synchronize this to coordinate them towards to be with some global net sustainability type of matter. And the key takeaway and the thesis of my presentation that circular economy systems engineering offers such a holistic system systematic if you wish framework to bring together the various pieces of the puzzle together. So let me elaborate a little bit more of this through a number of examples who demonstrate different aspects of the circular economy systems engineering approach. So if you look from an energy transition first point of view, and we're trying to start substituting, you know finite resources in energy based on a fossil fuel scenario towards renewable sources. Then we can think about, for instance, you know, taking advantage of wind and solar energy so here is an example of such an approach where you're trying to optimize renewable energy carriers, such as hydrogen methanol ammonia as part of a hydrogen economy of the future, where production of these carriers are through mostly renewable type of technologies, and then you try to produce them where the wind is blowing and the sun is shining mostly, let's say in some parts of rural Texas in the north, in the west in particular, and then ship this out and produce electricity, a la carte for a particular percentage let's say somewhere in New York. And this scenario that can be approximated or, you know, used in many instances around the globe. And this is part of a major activity that we have been working on at the energy institute for almost now, five, six years in collaboration with the long range research of Shell, where we're trying to transition for a reference case scenario based on primary fossil fuels towards a scenario where everything is fully renewable, but there's no magic button that can take us from the reference case to the long range same. So the devil is always in the transition. So we're trying to analyze what is the optimal pathway through some hybrid transition period and technology case that can take us to us to do the long range aim, both in terms of time dimensions in terms of technology dimensions in terms of risk dimensions. So what are the, if you waste some of the systems engineering aspects that are important here so here is an example for instance, of a map of the, of the heat map of wind within Texas and the heat map of the solar intensity in Texas and you can see that are the parts where you know you don't have neither with no solar everywhere whereas you know and you can see that as places that you mostly need. You are not blessed to have not as much wind as much solar as some other parts which are not as popular. So the idea here of the approach that you know so in order to address this important challenge, you bring together aspects of detailed design if you wish on the production of these chemicals. One advantage how you're going to design the supply chain that will bring those chemicals to the market where you need it and delivering if you wish electricity through, you know, through some installation of some battery capacity also with the wind or so that you synchronize the operation on the electricity demand based on the supply chain and the production. And what you're doing here in essence, from a methodological point of view, you're trying to address the various multi scale issues here we have multi scale issues in terms of time, because you know there is, there is not synchronicity between the production of electricity which is let's say the minute, or like the delivery of electricity at the, at the millisecond if you wish time scale with the production sign the supply chain, as well as in terms of dispersity in terms of where the sources are in terms of actual location, and then you bring together various components of methodological aspects, like the fact that you can need to trade if you wish energy efficiency versus life cycle analysis metrics versus type of risk in terms of technology, given the uncertainty and the stochasticity that exists, and you bring together modeling data design aspects and operation. And that, so that isn't one exam of one particular system like of an energy, the design of an energy system for the future. Now if you try to bring in tandem with such a holistic approach aspects related for instance to water and food things are getting even more complicated so so let's let's have a glance as an exam on the food energy water nexus here is a project that could have been involved for the last few years as just as an exam to see the key message is here so we're looking at San Antonio. This is a regional L in Texas, and this is pretty much the metropolitan area of San Antonio, and what I would like to draw your attention is the various colors so you see this is the various if you wish dots where water is used blue for municipal green for irrigation and red for energy. And now what is important here is not only that you know these are competing with each other you know as you're the population is growing and the precipitation keeps on going down. So there is a demanding craze in terms of water competition competition between municipal irrigation and energy, but what is even more striking is that different pieces of legislation, if you wish, guide the operation and the whole market of how water is drawn for instance by the city by the culture, and by the thirst for the wells that are scattered around the region. So here you have a classical exam of interconnected players, which have different of different stakeholders that are governed with different policies and laws, and they have different objectives, and they coordinate different parts of the next series. You have government, you have business, you have society, and you can see that you know there are different ways that this the state holders interact with each other, and addressing this nexus hotspots in a variety of way. The key point here is that there is no a unified with legislation and policy protocol that governs these interconnected players and that's very important. The, it's the first time actually, last year, a couple of years ago, you know in 2019 that we saw this integration of energy and water research, so this is that passed through the, the bill passed through the house science space and technology on the subcommittee on energy. And here is you know in I would like to draw your attention that when circumsideration of water intensity of the Department of Energy Research Development demonstration programs to help guarantee efficient reliable and sustainable delivery of energy and clean water resources. So the time is coming for even legislation and laws to fall laws and policies to follow the need for such an integration that essentially will allow us then to start addressing the complex systems and networks that underpin, if you wish the links between the the important research questions and business objectives and practical aspects as we try to navigate the space from a municipal point of view, from an agricultural point of view, from a water point of view, and from an energy point of view. So just if you take if you wish and as an example, the energy in red, so on here, key question from the energy sector to the municipal sector is what is municipal energy demand what is the, the, what is the profile for the future, and how we can do what will be the optimal energy portfolio in the mix if you wish to meet this municipal demand from a water point of view, what is the energy footprint for water, what is the optimal portfolio to meet water demand for energy, and then what is the energy footprint for agriculture, and so forth and so on so we can understand the interactions of the various aspects of the extended if you wish, value and supply chain. So that offers huge challenges, both from a methodological but also from a policy aspects, as well as creating the necessary legal frameworks that dictate if you wish the design operation of such system. And that takes us back to my favorite topic which I hope you have fully comprehend by now which is coffee. So let's revisit now the supply chain of coffee, and look at it like from the point of view on how we create a holistic framework towards analyzing designing and creating opportunities for the future so question number one is how can we make informed decisions for the transition from a linear to circular food supply chain in general, and let's use coffee as an example. So this is some of the key pillars of steps if you wish towards what we call a systems engineering framework for the analysis and design of the circular economy systems of the future. And I'm looking so so we're looking at production pathways ways utilization pathways representation that includes this alternative pathways in a cohesive type of mathematical model that then we analyze and solve and then analyzes from a risk cost energy efficient and the like so just to give you a flavor of what this methodological framework so about here you see a number of alternative production pathways from fresh coffee cherries, you know, different methods that exist and different steps for every method. Then you can have pathways as far as waste utilization is concerned at the palm husk silver skin and spend coffee ground you know so those open up even more possibilities, and then you put everything together. This is like a reverse supply chain if you wish, creating a bio refinery mimicking a bio refinery if you wish based on spend off ground right you know so we can start now. Analyze so that's what you need to be an understanding the pathways the chemistry involved here, the production facilities you know does it make sense from a life cycle analysis from a cost point of view and so forth. And here is some of you know initial results of what this type of analysis can do this is like if you wish a representation that allows you to put all those conceptual pathways together, and then you can do like some type of modeling and optimization to come up for instance with promising pathways, and then you can do trade off analysis, like trading off energy versus minimum waste and see the various scenarios in terms of different production steps if you wish, based on these various options that you're heading. That gives you with some, some means to be able to assess this type of scenarios in a systematic way. And that brings me to the final points that I would like to make in this presentation. First of all, the desperate to need for a unified metric. And here what I'm trying to attempt is like a glance of a first attempt towards such a metric development and for, let's say for the use of various of a of a businesses industries and so forth, where you look at a reduction material losses to the ways, the reduction of input and use of natural resources of procurement and water, increasing the set of new resources that's the energy of the waste dimension, emissions and spillages, and then durability let's say that links to resilience and reliability and just as an exam like energy, you're able to measure what is the percentage of the penetration of renewable energy vis-à-vis the total energy consumption that an organization and company or a business needs. And that allows you to start now creating maps of solutions and visualization tools like this, where you can map the waste, the emissions, the energy, the water procurement and durability in terms of an index as a function of time, from zero to one. And then you can see for instance, how you trend in terms of durability in terms of water, you know, and the rooms for improvement in each one of those vectors, and you can go even a step further and aggregate all these, let's say by taking like a combination of all these metrics in some scientifically sound way, and you create, let's say, an index for circular economy, which gives you if your overall performance as a function of time, and that can be used as a valuable information, both to consumers to producers to businesses, and you know to the market as a whole. So let me close my seminar by first looking at some open research questions, which I hope are articulated through the exams and the various challenges. First of all, I think one of the key aspects is an attempt to develop some kind of a consistent basis so that we are able to cover different alternatives towards circular economy, on an apple to apple basis and not on an apple to orange basis. Then a second major open question is the uniqueness, you know, like you know there are many combinations like I like some of these that you can arrive at circular economies, which ones are scientifically specifically, you know, analyze them from a certain dynamic limit point of view, analyze them from a uniqueness point of view robustness resilience support, which of those are going to be more efficient from a technical economic point of view, but also you know, from an overall point of view from a lifecycle point of view. Then it's the issue of scale. Are we talking about is it better to go towards centralized type of systems designed or decentralized in other words, is it more suitable to think of assist for a circular economy based on decentralized aspects or not policy regulations play people tell importance, not only in in providing if you wish incentives towards the adaptation of circular economy, but also because they play key role if you wish in the acceptance of such approaches, and then of course the overarching if you wish challenge remains winning desperately a science based engineering with different systems and approach along the lines that I have been offering. So a couple of takeaway messages to close this seminar circular economy relies on systems wide innovation so it has been primarily led by practitioners the business community and policy makers and there is indeed for building a strong scientific basis. I have articulated the fact that the systems engineering approach can have a big impact on the understanding and analysis of building circular economy supply chains and towards the convergence of different disciplines towards a common vision of the site. So, we are articulated that see a circular economy systems engineering provides the glue between various domain and science and the generic basis and links to policy regulation and sustainability approaches. And I would like to close that it can offer also a model for the generation next, if you wish, for from a societal point of view, bringing science based systems analysis towards materials, effective resource utilization health aspects, the nexus which is going to be a people for the future, and overall sustainable manufacturing. Thank you very much I'll stop at this point I will be glad to take any questions, and let me tell you how honored I am to be the part of this distinguished seminar series here at the global type tech center at Arizona State University. Thank you very much for your attention. Thank you. Thank you very much for a wonderful, a wonderful lecture. We just have really a few minutes of time everybody for some q amp a. Please let me start off with one question and we'll get to some of the ones that started here that was a really, I think comprehensive holistic approach and you brought a number of times you brought up this, having to balance where we are today with tomorrow. This notion of transition and I think that folks in engineering and in chemicals and processing systems analysis often have a lot of confidence and optimizations that folks in the sustainability field don't necessarily share. I wonder if you could talk a little bit and maybe this is within the Texas energy crisis in the shell example. Optimization versus sort of adaptive management, how you're the systems protein you're bringing actually let's be flexible and adaptive. Yeah, that's a great point George thanks for bringing you know there is an opportunity for convergence of terminology and expertise of you wish and in my opinion I don't see I can see convergence between, you know an adaptive type of management, you know, which essentially allows us to navigate the transitions from A to B to C in an adaptive manner through modeling and this type of systems approach which essentially can mimic, you know so we can create with modeling paradigms which can convert the adaptive management style into some quantitative kind of analysis so I see this opportunity for convergence of the various fields. And especially for navigating the transition space and I see there was a question on how, you know, like, do we exclude what we include in the analysis of transitions or do we exclude many aspects. The wonderful thing and why I personally believe in circular economy as a model, and I offer this holistic approach is that we don't exclude anything in fact you know because if you look at how we define the technology breakthrough that can take us back to the natural resources, big and fossil or whatever, that in a way essentially addresses, if you know the balance of renewables versus any other type of scenario right you know, and this is intensified by the fact that there is not a magic button that can take us as I said from A to Z. And if you think also like you know many people advocate the use of batteries as a solution to everything right you know in the future of the future, and that's another exercise or an adventure really in resources utilization, you know, like, and if you look at from a lifecycle analysis and resources utilization in general, you know where are you going to find the lithium or any rare metal, other than Bolivia or any other country right you know so and so so essentially some one of my key takeaway messages and I think what the community as a whole as a scientific discipline is converging is that everything is on the table, and that we need that's my thesis on top of this is that we need the quantitative framework that will take us through the most promising perhaps solution spaces and that will allow us to navigate in a consistent basis. So we compare various scenarios, we do this in a holistic holistic meeting a multi attribute point of view, breaking the various stakeholders together, and it's systematic way so that's the key message. Yeah, and that's interesting we have another question from from Kevin duly a professor here in the business school and who works with us at the global Kentucky Center. I'm noting that a lot and I think this is important for what you're saying, externalities, the current externalities are often only coming to the conversation at scale, when we see the economic implications, or through some sort of policy push. Just given what you described and through your talk. It's like doing by, by, by bringing visibility to these pathways and to these externalities and how they aren't just negatives, but their pathway models you know their ways to solutions. We can maybe open up another leg in moving to action, rather than just economics or just policy, and through knowledge and visibility, or do you still feel like yeah I know at the end of the day it's economics and policy and we're just bringing the science into the into big. I think, I think you need to to tango sometimes three right you know so in a, in a way, policy definitely can drive science technology can offer pathways towards new possibilities. But at the end of the day, we need to synchronize the business drivers with the policy drivers and the technical and the technology drivers right you know now the dynamics of these spaces may be different. You know you saw the example the food energy water nexus, some of the science exists, almost for a decade or so, only recently there was a need to, you know from a legislation point of view to synchronize water with energy right you know. So, so we need to pay a little bit more attention on the time constants if you wish of the system towards reaching solutions that can deliver such holistic approaches, clearly, the business driver often. I mean, it cannot be overlooked for for sure, but policy can offer incentives and technology solutions, you know, by bringing different science domains and then genetic approach to things is necessary to provide the glue towards what can happen and what cannot have. Right. Right. Absolutely. And it, and it can create trust. It can create risk, you know, like understanding of the risks involved, not only in terms of cost, but technology, but also confidence, you know, you know from an overall, you know, acceptability point of view. Well, we unfortunately we're out of time here we have we have another one of our guests said maybe we should talk about the conical economy as we had another dimension of consumption. And then one of my colleagues internationally asked about the speed of change in technology but and we'll have so you guys will have to leave everybody with. You know, we are, we are bound by the speed that we need to go within an hour but speed of change is attached upon it because that's a risk right so you know when you do this analysis, the time dimension, like acceptability or a red the ability of the technologies and acceptability by solution a different time is this is very important so. Yeah, yeah. All right, let me let me thank you against us but let me turn it over to George Stephanopoulos to close us out here. Can you hear me. Yes, George. This was a wonderful to the force on the system science behind the circular economy. We take your message very, very seriously, and we agree with the main thrust of it. The overall comprehensive and integrated view is, in our opinion as well, the way forward. And as the global kind of center we look forward to enhance the interaction with you as time goes by. The thing that I did not mention is that this webinar comes with a compulsory physical visit by you. I know you are vaccinated so we're discussing how we can do that as early as possible. We'll be delighted, George. Thank you for the kind of. Once we lost George there for the time. This event. To present to you. Can you hear that like.  There you go, you're back. All right. Oh, my God. I'm very honored. I would like to thank you all. I mean, great. Thank you very much. I mean, this is a great honor. I would like to thank all. Thank you. You're going to receive that. That's great. Thank you so much. All right, let me, let me jump in jump here. Thank everybody who's still here. I think we have a great honor here. And I would like to thank Stratos a real a real pleasure, a real honor. We'll of course follow up and anybody who's still out there. We're happy to gather questions and share them with Stratos. And congratulations on being our first distinguished inaugural lecture. And with that. Bye. Thanks all.


Ukraine needs fighters more than ammunition, the Washington Post. Kiev has almost no trained soldiers left. While conscripts refuse to fight for the Ukrainian authorities, the Washington Post says, as Ukraine approaches its third year of war, these people are needed more than ever. Leaders are still asking for more arms and ammunition from the United States and Europe, even if signs of weak support among those allies indicate Ukraine may have to do more to arm themselves. But even more than ammunition, Ukraine needs fighters, which leads to the search for new ways to mobilize the population and strengthen measures against draft dodgers, the article says. Honestly, we need more soldiers. The professional military personnel are running out. The Daily Quote, an army officer identified by his call sign, Dolphin, a 68th Brigade Assault Team Leader, as saying. The newspaper also notes that interviews with draft-age Ukrainians suggest that many are less than eager to fight for a military and national government that is viewed as a rife with corruption and incompetence. General mobilization has been repeatedly extended in Ukraine since February last year, with the country's authorities doing everything possible to prevent men of draft age from evading service.


Hi, my name is Commander Tai Do, I am a Public Health Emergency Officer and Navy Physician at Navy's Medical Command Headquarters in Washington, D.C. Contact tracing is a disease control measure used by medical professionals for decades to prevent the spread of infectious disease. It is a key tool in stopping the spread of COVID-19 as well. In general, contact tracing is relatively straightforward. It involves interviewing an infected individual to identify people who may have been in close contact for a specific period of time, then notifying those individuals of possible exposure and assisting them in understanding what they need to do to keep others safe. Your unit's medical personnel may need your help to conduct contact investigations. This video will give you an overview of what contact tracing means and the basics of how it is done. Even if you don't expect to be doing contact tracing yourself, this information may be helpful to you if you find yourself becoming ill. Your ability to assist in contact tracing may be a key to eliminating an outbreak on your ship or in your unit. Since this is a new virus, we are still learning about how it behaves and how it is transmitted. So this guidance may be updated as we learn more. When a person is identified to have COVID-19, part of the effort to slow or stop the spread is called contact tracing. This involves identifying close contacts and quarantining them. Close contacts of the COVID-19 positive individuals will be notified that they have likely been exposed and will be placed into quarantine. In the Navy, we are using a more specific definition than the CDC and are counting as close contact the following. Someone who was within 6 feet of an infected individual for more than 15 minutes. This would generally include someone who has a workstation or a rack within 6 feet of the individual and would also include prolonged interaction within a relatively combined space such as the galley, gym, smoking deck, and chapel. It is not close contact if you briefly pass the individual in the passageway. Been in a general vicinity for less than 15 minutes or been in an open airspace with the individual as long as you were more than 6 feet away. An exception to this would be if someone with COVID-19 sneezes or cough in your direction and you are exposed to the respiratory droplets. So while close contact is someone who has been exposed, it doesn't mean that they are infected or contagious. Just that we are monitoring them for possible infection. In the Navy, close contacts will generally be quarantined for a period of time to ensure they are not infected. Contact tracers will also help to explain this process and help individuals understand what they must do to help keep their shipmates safe. Contact tracing involves following up with individuals who may have been exposed to COVID-19 and is a key tool in stopping the spread of the disease. Even if you don't expect to be doing contact tracing yourself, it may be helpful to you if you find yourself becoming ill. Your ability to assist in contact tracing may be a key to limiting an outbreak on your ship or in your unit. More training is available for those who can help. Contact your medical department for details on where to find the training.


Good morning. Thanks for coming out. I hope everybody had a good evening and is rehydrating now. Welcome to a multiplayer metasploit, tag team, pen testing and reporting. I'm Ryan Lin. I'm an information security engineer for sass institute.  So this isn't my day job, but I think that it is a great time. So we're going to start off by talking a little bit about why we did this. So talk a little bit about why I think this is a really cool thing. Talk about what solutions are out there. Currently talk a little bit about how all of the communication happens. Discuss a little bit about types of objects. And I'm actually probably going to do demos early to make sure that we get to see fun stuff first. So the reason that I started working on this is because when I was doing pen tests with other people, it was hard to organize information. You know, we have wikis, we have dratus, we have all sorts of other things. But it all requires some good attention to detail from the people working. If you have results and you're multitasking and you don't upload them right away, you can have people waiting for data. You can have people that have incomplete data. And overall, just making sure that in a team environment, especially when it is in a separate physical area, so you may have one person testing remote, one person testing locally, or even people in different rooms in the same building, it's hard to make sure that you have all the coordination there. So it occurred to me that metasploit has a really powerful database back end. But the problem is that it's hard to get to that information right now. Unless you're sitting in front of the console, pretty much one person can work on it at a time. So what was missing for me is I use a lot of the XML or PC capabilities, which allows you to remotely talk back and forth to metasploit. So since there wasn't a database module, I said, okay, fine, I'll write one. So I went ahead and made it so that remotely you can talk to metasploit, you can push data in and you can get data out. So now that I had that part, I wanted to make sure that I had some good ways for some of my applications to talk in. So you're going to see three examples today. The first one is in map. The second one is going to be Nicktoe. And the third one is going to be beef. So what our goal is, is instead of doing tasks, then when you're done uploading stuff in, what if you could go ahead and your scanners directly log the data into metasploit? Then at that point, what you really have is you have real-time actionable information in metasploit. So as you're going through your process, you're not waiting on other people. You're not wondering, hey, is this information complete or not. There are programmatic things that you can do to find out whether or not someone has started a task, completed a task, what the status of the data is in the database, and as you start building profiles, for instance, you know, most scams start at low IPs, go to high IPs. You know, once you have a couple of different types of scans running, you can already be looking at information from some of the first parts of the scan before the scan is even finished. So that's the basic problem. So that outlines most of that. The other piece is reporting. So two of the things that, holy crap, you guys want to riot too? No. But so basically, the one of the problems is once you have all this data, how do you get a delta from one test to another? So we already have all the data in the database. So programmatically, it should be pretty easy to say, tell me what things are different from the time before. Also, there's no easy way to automate reporting once you get all this data in metasploit. You can look at your hosts. You can look at what exploits ran. You can look at all that. But, you know, how do you dump out a report that says, this is what I did. This is what time it was. You know, what got me shells back? What didn't get me shells back? You're lying a whole lot on the people doing the pen test, being really scrupulous about one information they're writing down. Also, if someone comes to you and says, what happened at this time? It's nice to be able to go, okay, let me look at this specific time period and say, these were the tests that we were running right then and have all of that in a central location. So right now, I think Drey this is one of the strong alternatives to this right now. But the problem is back again to, okay, so we're running tasks, then we're putting data into the database. And then we can sort of correlate there. But it's all people having to be very diligent about as soon as they're done getting results, making sure that things are uploaded. You don't have any real-time analysis. And especially if you have scans that are long-running scans or, you know, scans where you have multiple pieces, you know, it's not necessarily extremely easy to put all that back together and get a comprehensive view of what you've got. Leo, I included because it's on the backtrack CD. So I know a lot of people are familiar with it. And it's not really geared for multi-person, it's really geared for only one person. And wikis are cool, but they're really arbitrary. So you have to be very good about having a librarian to keep all your information together. So since Metasploit is really accessible, you know, I think probably everybody knows where to get Metasploit. I decided to extend the XML RPC stuff to facilitate the database transactions. And this is some stuff that Metasploit Express already does, but it does it through some other methods. So I don't have money. So I thought that this would be a good way for me to get the same information. So I just went ahead and created a database module and then started figuring out what extra pieces I needed to add to it for it to be useful to me. So the XML RPC extension allows the central logging of all the information. But the most important thing for me is that all this information is actionable. So as far as when you're pulling vulnerabilities in, when you're doing all of the scanning, all of the information that you have available is information that you can run Metasploit modules against, is information that you can query from other applications to perform further tests. And overall, it gives you a central store of information where you can have applications pulling and pushing data out so you can have very up-to-date information that is available to your applications and your testers. So I'm going to, instead of doing that, start off just showing you guys some stuff because that's a lot more fun, I think. And then we'll talk about how it works for people who are interested. So the first thing I want to show you guys is, last year I released a tool called InSploit, which allows you to launch attacks from InMap and use Metasploit on the back end to actually perform the attack. So as InMap is going through, InMap can call an InMap scripting engine script to go out, talk to the Metasploit database, and then Metasploit will launch an attack on InMap's behalf. So along those lines, most people probably don't want to just start throwing exploits out there. But the InMap scripting engine is very powerful. It has port rules, which will allow us to say, if a port is open or in a certain status, let's fire a job. So the job that we're firing in this case is I've added the code to InSploit for this year to be able to directly talk to Metasploit and add hosts into the database. So the first thing we're going to do is we're going to start up the MSF console. And I've created a little RC script here that starts off by connecting to the Metasploit database as the user MSF to MSF. And Metasploit is going towards using Postgres. For a while, you were able to use SQLite 3. But as the product becomes more powerful, you really want to look at switching towards Postgres. And Postgres is on back track, so it makes it a lot easier. So we're going to connect to our database back end using user ID MSF to the database called MSF. Then we're going to load the XMLRPC module using our elite password of ABC123. And the server type function is important. For a lot of this stuff I'm going to be showing, I'm using the web version. There's also a raw version, but the server type web is important because what this allows us to do is to communicate via the server over HTTP using XMLRPC. With a lot of the stuff that is out there, this makes it just really easy. If you use the traditional server, that's a null terminated, raw XMLRPC. And so you have to write some transforms for your code. So we're just using this because it's easy and I'm lazy. So we'll go ahead and start this up. And as it goes through, you'll see the database creating objects. Actually, let me make this bigger so you can actually see the database creating objects. Can people in the back see that? Maybe? Yes? Okay. Well, if you can't, then wave at me and I'll fix it. We make this a little bit larger as well. Okay, so what I've done is through InSploit, which is, again, a series of NSE modules and NSE scripts for the NMAP scripting engine. I'm going to basically just run a raw scan right now. Once you have InSploit installed, the Metasploit modules for actually adding the ports are set to run by default. So if you install it into your distribution, then it will go ahead and try to add stuff for you as it can. So we just have to do an NMAP-A and type in the right address. And so we're going to just start scanning our local little network up here. So back here, I have a listener for the XMLRPC channel. So one of the things that you'll notice is over here for NMAP, we're actually going to have data flowing through XMLRPC coming into our database before NMAP is even putting the data to the screen. So we're going to have more up-to-date information in our database than NMAP is even presenting us to the screen as we're scanning. So that's, I think, one of the pluses. As you're going through a scan with NMAP, especially for longer stuff, you're going to have data that is actionable in your database before any of this other stuff has happened. So there's NMAP sending all of the wonderful goodness into the database. And you can see that it hasn't actually printed anything to the screen yet. So we now have hosts that we know about, and we're just now seeing some output to the screen. So I'm going to let this go for a second while I talk about the next part. The next thing that I wanted to do was to be able to get some vulnerabilities in, to be able to really talk about, to really get a better picture of how all of the stuff was fitting together to be able to look at a whole host and figure out what vulnerabilities and what other actionable information we have. So I chose NICTO because I do a lot of web stuff and created a new report type for NICTO that would allow us to, as NICTO is scanning, go through and add vulnerabilities to the database. So now that we're done with the NMAP scan, we can look at our hosts and we have all of our host information and we have our services and we can look at all of that information. So as part of the scan, we discovered that we have a server here that is listening on port 80. So let's go over to NICTO and look at exactly what vulnerabilities that might have. So our format for NICTO is right here. Basically, what we have done is we've created a new reporting format. So I'm going to be releasing all this code on Monday on my blog, but the new format requires just a little patch to NICTO and will hopefully be in the distribution coming up within the next month or so. We specify our output file, which is the dash O, as our username, colon password at the URL for our RPC listener through Metasploit, which Metasploit listeners by default are on 55553 and use for the HTTP version a RPC directory of RPC2. So we choose our host the <IP_ADDRESS> and we'll just watch it start scanning and then we can look at that information going directly into the database. So with this, with NMAP, it has to do a little bit before it actually starts running scripts. So as it is actually doing the port scans, we're not getting that data back, but as soon as NMAP starts the script portion of its scan, then it will put data into the database during that portion. With this, it starts pretty early. So we already have vulnerabilities in our database. So as it continues to add, we can see that number increasing. One of the important things to note about this though is if you notice there's not a whole lot of data here that's very meaningful. And the reason is most of the time when people are using Metasploit, they're looking at the vulnerability references, because that's what gets you the exploit modules that you can use to further gain access to hosts. So the thing is, all of this data is actually stored in the database. So we're actually going to be able to get more data out of Metasploit than what is traditionally printed to the screen through some of the reporting capabilities that we have. So as this goes through, we now have all of our vulnerabilities pushed in. And as you can see, we have a couple of different vulnerability references. So the next thing that we want to do is look at how to use this for reporting. So right now we have some hosts in here. And if we want to get a full picture of what's going on, we can look at DB hosts and say, okay, we can find our host and it's alive. And we know when it was added. And we can go over to DB Services and we can say, okay, so let's match this up with the information that we have. And then we go over to DB Volms and, okay, so that's not necessarily the easiest way to get to all this. So instead, I wrote a host infoscript. And what the host infoscript is going to be able to let us do is to pull a full profile for a host that we have in the database and get all the information out. So there's four sort of core pieces of information that Metasploit stores about hosts. We've got the host information itself, which is like when the host was discovered, if it's up or not, all that stuff. Service information, which is the basic stuff we get back from NMAP, what services are, whether or not they're up, all that goodness. We have vulnerabilities which are pretty much a map host and service to a vulnerability type and store a little bit of extra data on that. And then notes which are sort of general purpose storage. And you can put pretty much anything in a note that you want to retrieve later. So the host infoscript that is going to be in the source that I distribute is going to be able to pull the full listing of everything that's in the database about a specific host. So let me go ahead and change this up to be the host that we were actually scanning. And so we basically specified it, the username and password for our XML RPC, our XML RPC destination, and the IP address we want information for. And so this is just some quick and dirty Python. And I'm going to go over how the code works in a couple minutes. But so from here we have all of our basic information. We've got the basic NMAP information about when the host was first discovered and last discovered. And so this is important for if you've run multiple scans or something like that, you can see which scans something went in as. The port information about what ports were found. And you'll notice there's no OS listed here. Typically if you have a couple ports open, a couple ports closed, then you'll get some OS information. But there weren't enough ports open to identify the host for sure, so I don't include it here. So for vulnerabilities, if you remember from the NICTO output there was a lot more verbose output. Here's the verbose output that we had from NICTO that we're getting directly from the Metasploit database. So we have all of that data from before and this will help us aggregate it. So where this is valuable is you have multiple pen testers working on multiple things. And so each person is probably concentrating on one or two things at a time. This will let you go into the database, pull everything you know about the specific target that you're looking at, and if you'll have immediately all of the relevant data for that host and one little report that you can look at instead of having to go for multiple places and possibly multiple documents to get the information that you need to really make some actionable decisions. So this just goes through list of vulnerabilities. There's no notes for this host so there's none included here. So the third thing I did is for beef, one of the things that you can do is you can really build some host profiles. But all that you know about the host while you're running beef, which for people who may not be familiar with it, beef stands for the browser exploitation framework and it allows you through cross-site scripting to encourage a target browser to execute code on your behalf. So basically what we can do with that is we can encourage the browser to run some fingerprinting information for itself. We can log that into the Metasploit database and then over time we can start building a profile of for instance maybe a company intranet just based off a cross-site scripting vulnerability. So let me go ahead and pull that information up. So what I've done is as beef is going through and gathering data, it's logging into the database. But also as you pull zombie reports, it's also pulling any information out of the database that you have about that host. So when you're looking at a host in beef, you actually have all the actionable information that you may need in order to be able to do real work with it. So this is the front end for beef. Let me go ahead and I've got a got a happy little Windows box over there that I have running our sample cross-site scripting. And so as we can see we just had a zombie pop up. So to start off with just for basic information we can go into our zombies and we can pull everything we already know about this host. So to start with you know this is all of the basic stuff that beef normally logs information about what the browser is, what the operating system is, resolution, all that good stuff and a little bit of information about the page it's on. So all of this information is now logged into Metasploit. So offline we can get to all of this stuff but also more importantly for instance if you have a couple people who are accessing the company intranet page you may be able to tell a lot more about what's going on with the company just based off this portion right here which is the HTML that was on the page that had the vulnerability itself as the person who was looking at it. So you can get a whole lot more information especially if you know maybe you're looking at testing an HR app or something like that you could really have the potential of maybe mining more information and showing that maybe the HR app has vulnerabilities by actually showing people what each person was looking at on on that page. So now you have all of this delicious information and you want to go ahead and further gather information about a host. So we can click on our zombie go under our standard modules and find out if it's got Java or whatever. So we'll select it and send now to determine whether or not the host has Java installed. You'll see over here that module code was sent and that Java is available and when we come back over here to our zombies we can see that it is both here in our module results but also here in the Metasploit information. But you can also come back over here and see we now have a bunch of notes about that host. So all of this is pulling it back and forth and and really merges things together. So again for for the beef portion if we were to have an internal host drop a little bit of JavaScript on it as some stored cross-site scripting then we can really build a large profile of an organization what types of browsers they're using through the auto run plug-in portion of beef we can start profiling what applications are installed in the browser and things like that. So I guess if you're interested in doing maybe further social engineering or further testing you have a better idea of what software may or may not succeed. So this will let you build a much stronger profile of an organization from a different perspective than what your typical scanning gives you. So the last demo I want to do is so right now we have some from vulnerabilities but you know most people are not going to want to just do Nikto. Most people are going to want to run Nessus or QALUS or something like that. Metasploit already supports a couple different file formats including Nexpos, QALUS, Nessus and I think there may be one or two others. But remotely it's not easy to push that data back into the database. So I wrote a quick script to just take a file that we have from QALUS or Nessus or whatever and go ahead and insert that into the database so that we have all of our data in one place. And again all of this stuff right now I'm doing it locally but the whole point of this presentation is you can actually do this multiple people from multiple locations and have this all centralized back to a central place. So multiple people are doing this. You don't just have to be able to do it from localhost. So we're going to come back over to this window and so I have this import file script and I have some happy little NBE files. So pretty much for import file it takes the same stuff as the host info does. Our XML RPC location, our username and file which we're going to use the illustrious test 2.NBE and we're going to go ahead and upload that. So we just now have uploaded our Nessus information. We look at our DB Volens again. We have all that information in there now. So now we can go ahead and pull another report and that one was for 236 and so now based off that Nessus data that we had which was completely different than the NMAP data we now have all of the same information that we were able to get before. So that really allows everything to come together nicely. So at this point I'm going to talk about code and how it all fits together for people who are interested. There's a couple different types of objects that are involved here. The first is workspaces. Workspaces sets a chunk aside for the project that you're working on. Where workspaces become nice is if you are doing a pen test of the same company multiple years in a row then you may be interested in pulling your database from last year for the same thing, opening a new workspace and then as you're looking at changes between the two years for things that have hopefully improved then you can compare the two workspaces programmatically to be able to determine what has changed and what hasn't. The host is pretty self-explanatory, services, volums and I'm going to go into these for just a second a little bit deeper. So the workspaces are pretty much just labeled by name. The name is arbitrary. It keeps some information about when it was created at and there's a description field to allow you to give it a more descriptive label like you know Ryan's pen test from 2009. The hosts have a lot more information in them. They have all sorts of information that you get from in-map like the name, exactly what flavor of OS it is, the address and there's actually a separate field for IPv6 so you can actually be looking in a host in the context of both the IPv4 and IPv6 address. The services, each service maps to a host and it includes just the port, the protocol, the state. It also has some name information about what that service is and you can also drop in some extended information. For instance, full banners and stuff like that that you can pull back later. The volums is actually a relatively small table. It has a reference to a host in a service. You have the name of the vulnerability. You actually have references for OSVDB or CVEs or whatever that relate to that and then you have an info block where we are storing all of that extended information about the full text of vulnerabilities. So notes are pretty cool because if you have something that's not a vulnerability but you want to keep track of it, you do that with notes. So notes have a note type which is essentially arbitrary. If you are developing something new, you want to keep track of it, you can create your own note type. Notes pertain to services and hosts. You can have critical whether or not it's been seen before and then it has a data block and you can store pretty much anything you want to in that data block. Most of the time objects are stored so you can actually store information, extended information about what you found. So for instance, if you're storing information about maybe V hosts that you found on a server, you can actually include an array of V hosts in that object and have all of that accessible when you go through and pull your reports. Events are important to figure out what's going on on the system. Every time you type a command, an event is logged. So you have the host that it came from, the name, whether or not it's been seen, username and then the extended info talks about what really happened. So if you have multiple people acting on the database, you're wondering who's doing whether or not a scan is started or finished. You can be logging the event information when the scans start and finish and tell real time what the status is and what people are working on. So then we have Fat Loots and for Loot, Loot is mostly used by Nextva or sorry, by Metasploit Express and the more commercial products, but we have it available to us as well. So with the Loot, it's basically anything that you have acquired from the host that you find to be valuable. We don't store the content necessarily in the database, but we have the host service information, the type of the stuff that we have acquired. And then the path variable says where to find that. So if you have a shared storage area that secure where you put all of the goodies that you required, for instance, maybe cracked password and stuff like that, you put the path to that. The data has some extended information about what that information is. The content type says exactly what it is. And then you have a name just to keep track of it. Clients are what we're using for beef. For all of the web stuff, we keep track of a couple different pieces of information as we have hosts come in. This information is also stored by things like DB Autopone and any of the other web parts that come in. We get information about the host, the full user agent string, but we also get some parsed out user name or sorry, user agent information like the name and the version. So if you are looking for maybe performing some further testing on an older version of IE, this would become very handy. You can just go in query all of our hosts that are running an older version of IE and then send them a little file to test out. For users, the user information isn't always directly visible, but we can view it. It is created automatically. There's a plug-in that will allow you to get to it from the console, but through XML RPC, we can get to it regardless. So we can store data here even the Metasploit itself is not storing data here. As we go through and we acquire some credentials, we have the ability to log all of that here for action in the future. This is especially valuable if you're doing things, for instance, you're wanting to do some pass the hash or things like that. We've got all of the tokens here and things like that that we can store to be able to further gain access on the network. So I have a little bit more time. So I'm going to actually go into some of the code itself at this point. The code for a lot of this is fairly simple. I'm using Python because Python has an XML RPC module that facilitates working with this stuff very well. So I'm going to start off by looking at just the host info stuff. So for host info, all of this stuff up top is just parsing options. So basically from the options that get passed in, we need a server URL that we're going to connect to. We need the username and the password to authenticate to XML RPC. So for XML RPC, there's a couple pieces of information that are really good to know when you're writing applications. The first is after you authenticate, you're given a token. That token is good for 15 minutes. And any subsequent request that you make, you pass in that token. After 15 minutes, then you won't get anything back except for errors from Metasploit. So you have to make sure you're renewing your tokens every 15 minutes. I occasionally, when I've done stuff because I've had slowness and things like that, ended up with tokens appearing to be expiring before the 15 minute mark. So typically when I'm writing stuff, I renew my tokens at the 10 minute point. So right here, we are opening a RPC connection into the Metasploit server. Then we call the auth.login function. And the auth.login function, we passed our username and password, we get back our token. If the result from that pretty much all of the calls come back with a result if it is a thing that you're asking it to do. If you're asking for data, you don't get a result back, you just get data back. So since we have a result back, we know that we were successful. And then we take the token from that, and we're going to use that for the rest of the stuff that we do. After that, we define our workspace. If we're looking at a specific workspace, then we will go ahead and assign that to our extra options. And after that, we just start asking for stuff and printing it out. So the get host says get all of the hosts that we specified on the command line. And then after that, it's just a matter of enumerating through and printing stuff out. So for services, we just drop into a loop and print out each piece of the object at a time. So it's not overly complicated. Probably as you're going through, there's not a lot of documentation on exactly what's being returned right now. There's a wiki page in Metasploit, which I'm going to start updating as soon as this makes it into the trunk with one information to return back from which pieces, so that there's some good reference for that. As far as the other functions go for XML RPC and the documentation subdirectory, there's an XML RPC.txt that has a list of what you pass to each one of the functions. So sorry, this is a little bit a pain to read, but basically we're just iterating through stuff and printing out each piece of the object in order.  So for decom.piphone, which I wanted to do something where I could test and make sure it's working, and decom always works on XP service back zero boxes just about, which is the awesome box that I've got up here. So for testing, it makes it really easy. So basically to only send it to hosts that have the right stuff listening, we specify our information about where to connect to up here. We're connecting to our local host logging in. And then after that, we are going to get a list of all of our services that are running on 139 for TCP. And so from there, we can make sure that as we're calling stuff, we're only calling hosts that are relevant. So from there, if you're going to be doing stuff like this, a lot of the time you're better off using multi handler than you are using the default handler for exploits. And for people who may not be familiar with multi handler, what it does is it acts as the handler for the exploits themselves. So you can have a whole bunch of different reverse TCP connections coming back in to the same place. And you don't have to worry about any sort of conflicts with ports or anything like that. So I do two things here. First, I start off by going ahead and running multi handler so that any connections that come back to the multi handler instead of the payload handler for the exploit itself, then I pull the list of services. And for each service that's listening on port 139, I run call exploit on it, which just does a basic execute for our exploit using our authentication token. And in this case, the Windows, DC, RPC, MSO3, 026D COM vulnerability. For this, we just have to specify our IP address, or sorry, the IP address of the remote host that we passed in, the payload we want to use, RIP. And then one of the important things is the disabled payload handler, which is what actually turns off the payload handler. This will also increase the speed as stuff goes out, because your exploit won't be waiting for something to connect back to it. It will send the goodness out and then wait for it to connect back to the multi handler. So for here, we have a couple things that are running on Microsoft ports. So we should be able to just come over here, run our dcomm.py, and it pulled the hosts that are in the database, and now we have remotely called the exploit, gotten back our host, and we have all of the goodness that we may want. So with something like this and with PSXEG, one of the nice pieces about it is, say you have gotten one host, you have captured some credentials, and you want to look at what other hosts in the network you may be able to get additional tokens on for past the hash. With PSXEG, you can go through, you can put in the credentials that you have right now, start scanning the network, and then use metropodors auto-run capabilities to do further information gathering as you're going through the network. So you may want to do something along the lines of WinEnum, which as it connects into the host, it can run your shell, comes back, and will pretty much profile everything about the host. As this goes through, you can start looking and further elevating privileges, using the information from there, but you'll also get a lot better network map as you start going through with that. Now the plus side is, is because we have already done an in-map scan, and we know which hosts are listening on Windows ports, we're only going to be sending the stuff to Windows hosts. So if you have some sort of network anomaly-based detection that's looking for traffic on, you know, Microsoft ports for Linux boxes or whatever, you're not going to trip that. And also you make sure that if you're limiting your scope, you're only making, you're only doing things that apply directly to your scope. So one of the scripts that might make sense for the future, if people are interested in making sure that all of the hosts that they've scanned, the information that they may do things that are actionable on is only limited to certain ranges, is go through, look at what all's there, and then delete everything out of the database before they are outside of their scope. So as far as the input goes, right now I just have it adding ports. But one of the things that would be really cool is for the in-map developers as they start writing checks for extended information about shares and all of the other goodness that's involved, to be able to drop notes through this to be able to, as you're scanning, log every piece of information that shows up as the script portion for in-map. So I'm going to look a little bit with you at the in-map stuff. So the latest version of InSpoight will run a lot more places. It has, before when, sorry, last year when I released it, it required an additional Lua module. Now it is straight XML or PC. It requires nothing else. So it should run on iPhones. It should run on any sort of device that you can put in-map on and has the Lua stuff installed for scripting. So for this, when you drop it in, you've got two separate directories. You've got your NSELib and you've got your scripts. So my in-map is installed in usual local. And so if you look in user local share in-map, you'll see that there's two directories which correspond to the NSELib, which is all of the core libraries that the other scripts use and the scripts themselves. And so pretty much you copy everything from NSELib and the exploit distribution over to NSELib and everything from scripts to scripts. And so when we look in the scripts, we have MSF AdPort. So basically for this, we have two separate pieces. The port rule says when this should fire. And so we've said that the port rules should fire whenever it finds a port that is in the open state. And the action when it does that is we start off by initializing the exploit stuff. And for exploit, you have a file that is in your home directory with all of the information about where to connect to. Otherwise you have to pass a whole lot of information to in-map and it's not a lot of fun. So the config file ends up being a lot easier. So the MSF init pulls your values in. And then for this, we specify our options for things that in-map has found for us. Our host IP, our port number, protocols, blah, blah, blah. And then from there, we can just issue an MSF call directly to the XML RPC API function. It goes ahead and takes care of the token handling for you. And the reason for that is in-map has some storage area where we can deal with that a lot easier than any of the individual scripts can handle it. So I take care of all of that in the exploit library. So pretty much all you have to pass to this one is the function you want to call and the options. So this goes out, connects to Metasploit database as the data and comes back. And a lot of this stuff has the ability to run in parallel. So I'm getting close to being to the end. So thanks very much. I've had a great time here. Thanks to all these people who've helped me get stuff going. And also especially to the people who've written the tools that I'm leveraging. Especially the Metasploit guys, Theodore and Wade Alcorn who've helped me a lot with stuff. So thank you guys very much. Here's my contact information. If you're interested in more stuff, let me know. Hit up my blog probably Monday evening and I'll have all the source code and I'll try to get the slides there. If you have any other questions, please just let me know. Thank you very much.


President Bola Tinubu on Monday expressed readiness to end the perennial farmer's heather crisis in the country. Tinubu vowed to draw up programs that would end the crisis within two or three weeks. He spoke during the inauguration of the mechanized agricultural project in Mina, Niger State. I contributed to the overall food security of Nigeria. We shall explore over three million of the 8.3 million hectares of arable land, large water bodies with a multitude of tributaries, 23 grazing reserves, and 94 forest reserves. Therefore, Niger State stands as a beacon of hope and promise in the realm of agriculture and our springboard to harvest our potentials in the green economy and appropriated gains. Food production. Mr. President, under your visionary leadership, Nigeria has embarked on a pragmatic agenda to secure our nation's food supply and uplift the lives of the people through agricultural development initiatives. It is heartwarming to assure Mr. President that Niger State is with you on this loud-able mission, sir, and will occupy the driver's seat and lead by example on this notable project. How do we feed our people? I use the economic opportunity to mitigate and correct the problem of violence, attacks, capsurously, and all of that. We are going to organize. Give me two, three weeks to be part of the inauguration of the livestock change in Nigeria, to commission the agricultural machinery, to enhance the irrigation, to put confirmation and truth to agro-precision economic zone that is being approved, and to equally partner with you to banish hunger. That's all.  You are working the talks. It is necessary for me to support you. It is mandatory as Nigerians. Subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.