First I'd like to note that I'm really a beginner at cryptography, and while this interests me and while I have researched it in the past few months, there is still a lot of things that simply aren't clear to me, and I would like to have them clarified so I can move on.
Let's say (because this scenario is what I have pondered and have thought about it for a while) that a client has generated a temporary RSA key pair, knows a server's public RSA key beforehand and needs to transmit its own public key securely to the server, in order to agree on a mutual, secret symmetric key, resistant to both eavesdropping and MITM. (I'm not aware of another, better way of negotiating a key when a client has a server certificate beforehand, but that would have more to do with my crypto incompetence.)
So the client encodes its (n, e) in a series of bytes and encrypts the data using the server's public key taking care of proper padding (using, say, OAEP). The server receives this data, decrypts it, and then wants to send its part of the symmetric key to the client. So it chooses this random key, hashes it using a secure hash algorithm (say, SHA-2), encrypts it using the client's public RSA key and fires it off into the network along with the hash.
The client now receives a hash and RSA-encrypted data. It decrypts it using its private key, checking the padding, hashes it, and compares to see if the hashes match.
My question is, is there even need for the hash in the server response so the client knows it hasn't been MITM'd (because the server has proved it decrypted the client's public key)? Can an adversary which doesn't know the server's private key ever change the RSA ciphertext so it passes the OAEP check routines? Even if this happens in some way, the client will end up using a garbage symmetric key—is this dangerous i.e. could be exploited in some way? And if there is legitimate need for the client to know at this stage absolutely no one has tampered with the message, is my simple plaintext hash-based authentication secure? I feel it is pretty obvious but I haven't stumbled upon its use so far, so there may be a good reason. I've heard that MACs are a good, secure solution, but obviously there is no shared secret at this point in the negotiation so I don't see how they can be utilized.
Am I missing something painfully obvious?