Client starts a session. Attacker sees this session, and waits for the response from the server. Server sends the response and the Attacker grabs it. Client receives the Attacker's packet, and now assumes a plaintext password should be used. Client receives the real packet from the server, but ignores it thinking it is a dupe.
Client sends the password in plaintext.
Attacker grabs the password and now logs into the Server directly. Client times out or gets an error, and figures a network error has occurred. Client tries to log in again. It is also possible in theory to catch the session before the authentication process even starts. Attacker sees this request, and forges a reply that the Attacker's IP address is the address for the host the Client is requesting.