tl;dr:
1. Notice that `qInv` RSA-CRT parameter (named `cf`) is not removed from public key
2. Use Coppersmith attack to recover `d` using polynomial `cf*x -1 == 0 mod q**2`
3. Decrypt the flag

Full writeup: https://github.com/p4-team/ctf/tree/master/2019-09-02-tokyowesterns/happy

Original writeup (https://github.com/p4-team/ctf/tree/master/2019-09-02-tokyowesterns/happy).