tl;dr:
- Notice the server doesn't verify if the point is on curve and we can send any point for encryption- Send points from different curve, with small subgroups- Use discrete logarithm to recover secret mod small primes- Use CRT to combine those into the secret- Use secret to decrypt password for letter `S`
https://github.com/p4-team/ctf/tree/master/2019-04-07-spam-and-flags-teaser/crypto_ecc