How can you extract the GlobalAddressList using the Offline Address Book (OAB) method, and what tool is needed to decode the downloaded file?

First, read the Autodiscover XML to obtain the OABUrl, then fetch the OAB file list (oab.xml) to locate the LZX file corresponding to the Default Global Address List. Download that LZX file and decode it using the `oabextract` tool to produce an OAB file, from which email addresses can be extracted with `strings gal.oab | grep SMTP`. This technique works even without direct Exchange server access, as long as Autodiscover is exposed.