Level 3 is a remote heap corruption issue. Source code can be found in /drifter/drifter3_src/. It is linked against an ancient malloc implementation so it should be easily exploitable :)

Once upon a free()... - suitable reading material, amongst others.