Rating:
## Solution
The solution for this is straightforward by using __extended euclidean algorithm__.
Given `ct1` and `ct2`, we observe that
```
ct1*ct2 = (flag^13)*(flag^15) = flag^(13+15) mod n
```
And we can get any linear combination of 13 and 15
```
(ct1^a)*(ct2^b) = (flag^(13*a))*(flag^(15*b)) = flag^(a*13+b*15) mod n
```
And for negative values of `a` and `b` we get the inverse of ciphertext.
```
modinv(ct1, n)^k = (ct1^-1)^k = flag^(13*-k) mod n
```
With that, we simply need to find `a` and `b` such that
```
a*13 + b*15 = 1
```
And this has a solution because 13 and 15 are __coprime__. We use the __extended euclidean algorithm__ to find `a` and `b`.
__For implementation details see the URL__
