from Crypto.Util.number import long_to_bytes
import gmpy2
p = 9109516638675942224743777995148545134530013554275734886455448931671863095997507569243594319863772181509837924098591463427796446396931029539716403962408943
q = 10740686879425642178311117871838817113230054398803925695044823186721569157087087148128828336409020272313601366223259400603169731251187486908754100440733959
c = 140655211554927678503347324092478047438045251131293471286425677406100240063574753515992620829045521915462201396598103882338968738138846160402436956319724406025
n = p * q
mp = pow(c, (p+1)//4, p)
mq = pow(c, (q+1)//4, q)
yp = gmpy2.invert(p, q)
yq = gmpy2.invert(q, p)
r1 = (mp * yq * q + mq * yp * p) % n
r2 = (mp * yq * q - mq * yp * p) % n
r3 = (-mp * yq * q + mq * yp * p) % n
r4 = (-mp * yq * q - mq * yp * p) % n
for r in [r1, r2, r3, r4]:
try:
msg = long_to_bytes(r).decode()
if 'flag' in msg:
print("找到 flag:", msg)
except:
pass