Path Traversal to NTDS: Check Point Quantum VPN Leak

An internet-facing Check Point Quantum security gateway is exploited through CVE-2024-24919, an unauthenticated path-traversal arbitrary file read. The attacker reads the appliance password-hash file and a VPN/LDAP configuration file, recovers the gateway's Active Directory bind credential, cracks it offline, then logs back in over the VPN as that account and extracts the Active Directory database from a volume-shadow copy on the domain controller. No malware touches the gateway. Reconstruct the kill chain from Check Point portal and VPN logs, Windows telemetry, and the perimeter firewall, and classify the key ATT&CK techniques.