Cisco rommon has a "secret"(not very well kept) section where you can execute some privileged commands.