# Extract Base64 PowerShell from Office Macro
> Get encoded PowerShell payload hidden in a VBA UserForm stream

**Tools:** [[tools/oledump-py|oledump-py]], [[tools/base64dump-py|base64dump-py]]
**FOR610 Lab:** 3.4

## Commands
```bash
# List streams — find macro (M) and data streams
oledump.py <document>
# Extract VBA source to understand what the macro does
oledump.py <document> -s <macro_stream> -v
# Scan data stream for Base64 strings
oledump.py <document> -s <data_stream> -d | base64dump.py -n 10
# Decode the longest Base64 hit to file
oledump.py <document> -s <data_stream> -d | base64dump.py -s 1 -d > payload.ps1
```

#recipe #oledump-py #base64dump-py