they usually do it through bugs and holes in apache and other server software which allow to run some simple defacing script