I had a wordpress site hit with one of these attacks years back.  I took it apart to see how it worked.  It was a pretty messy hack, but I give them credit for working within the constraints they had.