tl;dr:

- Notice the server doesn't verify if the point is on curve and we can send any point for encryption
- Send points from different curve, with small subgroups
- Use discrete logarithm to recover secret mod small primes
- Use CRT to combine those into the secret
- Use secret to decrypt password for letter `S`

https://github.com/p4-team/ctf/tree/master/2019-04-07-spam-and-flags-teaser/crypto_ecc

Original writeup (https://github.com/p4-team/ctf/tree/master/2019-04-07-spam-and-flags-teaser/crypto_ecc).