For me, the best aspect of TSH2E was the integration of real-world obstacles to exploiting victims. The book (although published in 2008) expertly addressed various defenses introduced in operating systems over the past decade. The authors usually start with simple concepts, promising to address tougher challenges later -- and they deliver.
One item early in the text caught my attention though. The book includes the following code to demonstrate spawning a shell:
name = "/bin/sh";
name = 0x0;
execve(name, name, 0x0);
Then they show the following:
[jack@0day local]$ gcc shell.c -o shell
[jack@0day local]$ ./shell
This looks like a section left over from the first edition by Jack Koziol. Why does the prompt change to a root shell? Should it not be a user shell, since user "jack" appears to have been running with user privileges? Maybe not?
Regardless, TSH2E is a very strong book with practical lessons and examples for anyone writing offensive code.