The modum operandum is simple: the cracker hooks up phpshell etc. to a domain on shared server space, and browses until s/he finds a database or other configuration information, then uses that from within phpshell to pry open anything they want (or so it seems from reading....)