He ran an exploit FINDER. He did not put exploit programs on the server.