When shooting at a war machine, shots are worked out against the entire unit, and any hits scored are randomised between the crew and war machine.
A war machine is treated exactly as any normal unit with regards to modifiers to hit. A war machine and its crew don't count as skirmishing, and so don't benefit from the -1 to hit penalty. Some War machines may be classed as large targets (this will be noted in the war machine's specific rules).
Once hits have been established, randomise where they strike by rolling a D6. If the result is 1-4, roll to wound the machine. If the result is a 5 or 6, roll to wound against the crew. Once all crew are slain or have fled, or once the machine is destroyed, further hits do not need to be randomised but will strike the machine or a crewman, as appropriate.
Remember that war machine crew do not take Panic tests for casualties suffered from ranged attacks, such as missile fire and spells.