Knowledge-enhanced Black-box Attacks for Recommendations