Conjecture: this is done via automated scripts that check for vulnerabilities and then execute the appropriate exploits on them, a la Metasploit. It's a comprehensive binary (or a few of them) that is supposed to be deleted when the work is done. :P