How does rooting work?
What the APK and exploit do (usually) is as follows:


The APK puts the right files in the right place to run the exploit
The APK runs the exploit
The exploit attempts to attain root access
If it succeeds, the exploit remounts /system as read-write and runs the installer script
The installer script attempts to install the su binary and superuser APK, and reboots


As an example, this page details how the rageagainstthecage exploit attempts to gain elevated privileges.