However this does nothing towards a realtime attack. Client starts a session. Attacker sees this session, and waits for the response from the server. Server sends the response and the Attacker grabs it. Client receives the Attacker's packet, and now assumes a plaintext password should be used.
Client receives the real packet from the server, but ignores it thinking it is a dupe.
Client sends the password in plaintext. Attacker grabs the password and now logs into the Server directly. Client times out or gets an error, and figures a network error has occurred. Client tries to log in again. It is also possible in theory to catch the session before the authentication process even starts.