I wanted to know what a person can do if he has access to the Router Settings? I know he can change the password and stuff but can he do any real password sniffing stuff?
depending on the router, you can set up a proxy server and redirect all traffic to said server.
This would allow you to do any MITM attacks you would normally be able to do but without having to ARP the victims. A simple google of MITM attacks could open up a large range of ideas for your self.
DNS attacks (e.g. redirection) and SSL stripping / denial are good example of things you can do if you set up a proxy server on the router.
Basically redirecting traffic to a device to handle it with your rules is a start, and then decide what you want to do from there.