According to Matthew 4:5, demons can at least affect a righteous person physically without harming him: “Then the devil took [Jesus] to the holy city and had him stand on the highest point of the temple.” “Stand,” in the Greek, histemi, means, “To cause to stand, to set” (literally, the devil “stood him”). Satan physically transported Jesus to the pinnacle of the temple. But surely he did this only with God's permission.
But can a demon directly harm a righteous person physically? According to Scripture, the answer is yes, but once again, only with God's permission. Satan obtained permission to afflict Job physically, with boils: “The Lord said to Satan, ‘Very well, then, he is in your hands; but you must spare his life’” (Job 2:6).
On rare occasions I have heard Christians claim that when Jesus came, He prevented this kind of thing from ever happening again to a Christian, for Jesus defeated the demons: “And having disarmed the powers and authorities, he made a public spectacle of them, triumphing over them by the cross” (Colossians 2:15). Satan cannot use any sin that we have brought to the cross in repentance. However, Job was not afflicted because of any personal sin. He was afflicted because God gave Satan permission, in spite of Job's righteousness. For that reason, I know of no commentary claiming that a predicament like Job's cannot occur today.
2 Corinthians 12:7 might confirm this. Paul said,
To keep me from becoming conceited because of these surpassingly great revelations, there was given me a thorn in my flesh, a messenger of Satan, to torment me. Three times I pleaded with the Lord to take it away from me. But he said to me, "My grace is sufficient for you, for my power is made perfect in weakness."
All commentators agree that the thorn had nothing to do with any sin in Paul. Rather, as the passage says, it was sent to keep him from sinning. The Greek word, "torment," is kolaphizo, which means, to strike with clenched hands, to buffet with the fist. Even though Paul offered Satan no sinful point of access, God allowed him to be buffeted with the fist. Does this mean demons physically harmed him, perhaps through discomfort or a physical ailment (some commentators suggest that Paul's "thorn" was poor eyesight — see Galatians 4:15)? Or did Paul use the phrase, “messenger of Satan,” metaphorically, of a spiritual or emotional buffeting? We don't know. No one knows exactly what Paul's thorn in the flesh was.
However, we do know the following:
1) The thorn was in his flesh. The word, "flesh," can be used of the sin in us, but it is also used of the body. This makes it possible that the "buffeting" was physical.
2) The Greek word for “buffet” means a physical beating. Although one might use any word metaphorically, this word's customary meaning was physical. Elsewhere in scripture, the word is used in this way (for instance, of the soldiers beating Christ (Matthew 26:67; Mark 14:65).
3) The thorn was “from Satan;” Satan was afflicting a righteous man.
4) The thorn was sent only by God's explicit permission, to accomplish God's purpose.
Conclusion: in rare instances and only by God's permission and for His purposes, a demon may afflict a person physically who offers it no sinful point of access.