with open('output.txt', 'r') as file:
    exec(file.read())
def exgcd(a, b):
    # ax + by = gcd(a, b)
    if b == 0:
        return [1, 0, a]
    c = exgcd(b, a % b)
    return [c[1], c[0] - a // b * c[1], c[2]]
def crt(a, m):
    A = 0; M = 1
    for i in range(len(a)):
        k1, k2, g = exgcd(M, m[i])
        t = ((a[i] - A) % m[i] + m[i]) % m[i]
        # assert t % g == 0
        k1 = k1 * (t // g) % (m[i] // g)
        A += k1 * M
        M *= m[i] // g
        A = (A % M + M) % M
    return [A, M]
A, M = map(int, crt(c_list, n_list))
print(A)
from gmpy2 import iroot
a = iroot(A, 9)[0]
print(a)
from Cryptodome.Util.number import long_to_bytes
print(long_to_bytes(a))

中国剩余定理解 m^9 同余 c[i] 模 n[i] 的方程。

解得 m^9 = A。

然后计算 a = iroot(A, 9)，得到密文，再 long_to_bytes 即得 flag。

也可以根据低指数直接爆破。