What are the traces of a mysql attack on a server when the attacker has full permissions?

Question

I just turned my server off yesterday, after it began to distribute comment spam across the internet, at an astounding rate over 70 "spams"/min, bottom of the line 1/2 gig ram VPS. I'm still trying to figure out how there are doing this, but one possibility is an injected file, injected by MySQL. The reason I'm suspicious about MySQL is that I may have leaked the credentials of a user with full power... Oooopss (Don't ever trust a .gitignore if you don;t know exactly what you're doing)!

The question for real:

How could I tell if somebody tried to add/modify a file on my server, given full admin mysql powers. Bonus if I can find the file... I have something really special planned for it.* The biggest problem is I don't have a mysql query log :/...

System stats:

• Ubuntu 14.0.4
• Apache 2. somthing
• MySQL ... ?
  I can look if you need, but I don't want to turn it back on if it can be helped

_{* I'd never attack back... ever... I was just thinking something like deleting it character by character, slowly and deliberately. Maybe sending it to some laboratory to test vaccines on, pointy needles required!}

---

Update: for those of you curious about what was really wrong with my server, I'd messed up a proxy pass to node so that anyone could use it.

Answer 1

Depending on the privileges the mysql user (the system-level account used to run MySQL) has and how MySQL is configured, the traces could be anything from a full audit trail in the MySQL log files, to no trace whatsoever.

Assuming the mysql user can't do anything but read and write files, your bet bet is to search the drive for files owned by that user. MySQL doesn't normally create files outside its data directory, so anything you find outside of there is suspicious.