I did this once as a teenager. Exploited a vulnerability on a multiplayer gaming site to remove a keylogger. Basically, a hacker I knew exploited the site to download a site's game mod, put a keylogger on it, and he uploaded it to the site (replacing the original) so he could steal game credentials. The webmaster didn't know. I used the same exploit to remove the keylogged file, fix the vulnerability, then notified the webmaster. The game mod was popular and had thousands of active users.