tl;dr:1. Notice that `qInv` RSA-CRT parameter (named `cf`) is not removed from public key2. Use Coppersmith attack to recover `d` using polynomial `cf*x -1 == 0 mod q**2`3. Decrypt the flag
Full writeup: https://github.com/p4-team/ctf/tree/master/2019-09-02-tokyowesterns/happy