If you're using Seven as your admin theme (which is the out of the box default) then the script may have been added in a template file inside /core/themes/seven
I think the easy approach would be to pretend you're upgrading Drupal 7 and delete all the files and folders with the exception of the sites folder.
After you "upgraded" your Drupal, if the problem still persists, then it means it may be somewhere in your sites folder. Check all template files, and keep a lookout for any strange .php file. Also, check if some module was added or altered using the Hacked! module.
If still no resolution, then most likely the script is in your Database. Due to you allowing FULL HTML on your text boxes or your DB was hacked.