Level 3 is a remote heap corruption issue. Source code can be found in /drifter/drifter3_src/. It is linked against an ancient malloc implementation so it should be easily exploitable :)
Once upon a free()… - suitable reading material, amongst others.