There are two locations, the REST/GraphQL controllers come from our core-api: strapi/packages/strapi/lib/core-api at master · strapi/strapi · GitHub
These are easily customized and we have code samples for these in our documentation here:
Controllers: Backend customization - Strapi Developer Documentation
Services: Backend customization - Strapi Developer Documentation
The Admin panel is a bit more complex and it’s separated from the end-user ones, the generalized controllers and services are in the content-manager plugin:
Controllers: strapi/packages/strapi-plugin-content-manager/controllers at master · strapi/strapi · GitHub
Services: strapi/packages/strapi-plugin-content-manager/services at master · strapi/strapi · GitHub
And to modify these you need to use our extensions system: Troubleshooting - Strapi Developer Documentation