Yes, it can be done. This is called a Password Authenticated Key Exchange. Such protocols reuse "asymmetric crypto" elements (such as Diffie-Hellman) and mix them "smartly" with a shared secret, so that:
- Client and server authenticate each other with regards to the shared secret.
- Guessing the shared secret does not allow decrypting past sessions.
- Nothing in what is recorded gives enough information to test potential values for the shared secret.
The third condition implies that a low-entropy shared secret, e.g. a "password", can still safely be used, hence the name for this kind of protocol. The cryptographic concept was invented in 1992 by Bellovin and Merrit, under the name "encrypted key exchange" (formally, a DH key exchange in which messages are symmetrically encrypted with the shared secret, so that decryption with the wrong secret still yields syntaxically valid DH messages -- the actual mathematical requirements are subtle).
In the context of SSL/TLS, a standard PAKE protocol has been defined, under the name SRP (see also the Wikipedia page). SRP is good. Unfortunately, Web browsers don't seem to support it (yet).