How to attack this authentication protocol from "Cryptography: An introduction" Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart):

A → B: A, Na
B → S: B, {A, Na, Tb}Kbs, Nb
S → A: {B, Na, Kab, Tb}Kas, {A, Kab, Tb}Kbs, Nb
A → B: {A, Kab, Tb}Kbs, {Nb}Kab


where the smaller letters are the suffix so example Kab means the Key shared by A and B.  Tb represents the timestamp for the message and Nb represents a nonce.

My question is: If an external attacker is impersonating A and S at the same time, how the attacker can manage to trick B into believing A is authenticated?  I'm told I should be able to describe how to do this in exactly 3 messages (omitting one of the messages in the protocol).

My attempted solution is: If A and S are impersonated then when B is sending a message to S, the external attacker will know what is being sent and therefore the attacker can forward the message as normal to A but can corrupt the message. I'm not able to write a protocol as it's a bit confusing.

See also What does this Authentication protocol achieve and what information is shared? for a related question about the same protocol.
If the attacker M is impersonating both A and S, then he obviously doesn't have to bother sending the third message in the protocol to himself.  Thus, the protocol reduces to:

M(A) → B: A, Na
B → M(S): B, {A, Na, Tb}Kbs, Nb
M(A) → B: {A, Kab, Tb}Kbs, {Nb}Kab


where M(A) and M(S) denote M impersonating A and S respectively.

By itself, this is not a successful attack: while M can pick any valid Kab he wants, he generally cannot obtain the corresponding ciphertext {A, Kab, Tb}Kbs to send to B.  However, if the formats for Kab and Na are compatible, such that M can choose Kab equal to Na, and if B does not check for this possibility, then M can simply replay the ciphertext {A, Na, Tb}Kbs he received from B in the second step, leading to the attack:

M(A) → B: A, Na=Kab
B → M(S): B, {A, Na=Kab, Tb}Kbs, Nb
M(A) → B: {A, Na=Kab, Tb}Kbs, {Nb}Na=Kab


Other attack methods may exist if the encryption scheme denoted by the curly braces is malleable, but the attack described above will work even if it's not.