The complete attack is as follows:

$C(A)\to B$ : $A,B,\{N_{C},C,B\}_{K_{CT}}$
$B\to C(T)$ : $A,B,\{N_{C},C,B\}_{K_{CT}},\{N_{B}\}_{K_{BT}}$

$2^{\prime}.$ $C(B)\to T$ : $C,B,\{N_{C},C,B\}_{K_{CT}},\{N_{B}\}_{K_{BT}}$
$3^{\prime}.$ $T\to C(B)$ : $\{N_{C},K_{CB}\}_{K_{CT}},\{N_{B},K_{CB}\}_{K_{BT}}$
3. $C(T)\to B$ : $\{N_{C},K_{CB}\}_{K_{CT}},\{N_{B},K_{CB}\}_{K_{BT}}$
4. $B\to A$ : $\{N_{C},K_{CB}\}_{K_{CT}}$

After 2', Trent will reply to Bob. Charlie may intercept it as shown above and forward it to Bob, who will see this as message 3. (Alternatively, with the same effect, Charlie just lets Trent's message go to Bob, who sees it as message 3.) Bob will finally send the first half to Alice. Charlie may intercept, but he already has and can decrypt that message. Bob and Charlie now share $K_{CB}$ , but Bob believes he shares it with Alice. Bob cannot see that the parts he forwards have been encrypted for Charlie rather than Alice.