Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks