Understanding a faulty Needam-Schroeder protocol
The trick here is that Trudy does not need to know $K_{bc}$ (as you mentioned, it's not public). 

However, what Trudy really needs to do is observe (by just monitoring the network) and store a previous "$K_{bc}(K,A)$" value that A has sent to B (publicly) beforehand (step 4). 

So now in any future protocol sessions. Given that $K_{bc}$ is going to be the same, Trudy has the previous value it needs to preform the replay attack.