wp

from Crypto.Util.number import long_to_bytes,inverse

def pohlig_hellman(g, h, p):
    F = GF(p)
    g = F(g)
    h = F(h)
    n = p - 1
    
    factors = factor(n)
    rem_list = []
    mod_list = []

    for q, e in factors:
        x_q = 0
        q_pow_e = q ^ e
        gi = g ^ ((n // q_pow_e))
        hi = h ^ ((n // q_pow_e))
        gamma = gi ^ (q ^ (e - 1))
        
        for k in range(e):
            prefix = gi ^ (x_q)
            target = (hi * prefix ^ - 1) ^ (q ^ (e - 1 - k))
            dk = discrete_log(target, gamma, ord = q)
            x_q += dk * (q ^ k)
        
        rem_list.append(x_q)
        mod_list.append(q_pow_e)
        
    final_x = crt(rem_list, mod_list)
    return final_x

g = 2
p = 79285813284486794813839488870777642585867364357675129135674472630283443088363
q = 59481776986304710122952330496120381060088487141009603943068237557918097596839
y = 3351991238506266239021694107058698748339971266787976105773294119047623555932161737873296945043573073435285055077688834343772763501204513075811601328570494
c = 1522491651270003396229800363206774621068196589011376346169585378931744431827180487402845924922464121836834697175617246404505868715069219608901802877153148

e1 = pohlig_hellman(g,y,p)
e2 = pohlig_hellman(g,y,q)

order_p = GF(p)(g).multiplicative_order()
order_q = GF(q)(g).multiplicative_order()

e = crt([int(e1), int(e2)], [int(order_p), int(order_q)])

n = p * q
phi_n = (p - 1) * (q - 1)
d = inverse(e,phi_n)
m = pow(c,d,n)
print(long_to_bytes(int(m)))