Is a random oracle controled by the challenger? When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger?

What if the Hash is only used by the adversary?
As @xagawa mentioned in his comment, it depends on what you mean by "controled".

In the case of using a programmable random oracle, yes, the reduction (in particular the simulation of the challenger of the real game) decides about what to return as answer to an oracle query. Thereby, the reduction has to guarantee that the "programmed" answers are consistent (identical answers to identical queries) and that the distribution of the answers are uniformly random to the adversary. 

Such reductions are the ones typically used for reductionists proofs in the ROM, as it nicely allows the reduction to embed a problem instance into the adversaries queries to make the reduction work.

Typically, the random oracle is also observable, i.e., besides the programmability, the reduction "sees" all oracle queries and thus knows how much queries the adversary has made to the random oracle. 

There are also works investigating non-observable reductions, where the random oracle is external to the adversary and the reduction. But they still can provide some means of programmability as the reduction can decide on the turing-machine that is used for the external oracle. In the linked paper you find some results for non-observable but programmable random oracles and also some examples for reductions in the ROM that also work if the observability is removed.

There is also the possibiltiy to have reductions in the ROM which are non-programmable and non-observable, but this enormously reduces the power that the ROM provides you in reductionists proofs.