Generally you need to grant the IUSR or Application Pool permissions to 'write' on your web server to upload files. The upload.aspx or whatever it's called could reside most any place. It could write to a folder called downloads.
Assuming this is a anonymous based site, you could turn on directory browsing and people could gain access to download files. Or have the default document in the downloads folder write out a file listing. Here are a couple articles using the built-in upload component in .NET 2.0
http://www.codeproject.com/KB/aspnet/FileHandlerPackage.aspx
http://www.15seconds.com/issue/061116.htm
My suggestion is pretty generic and there is security needed, you'll need to account for that.
Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield
http://www.IISLogs.comLog archival solution
Install, Configure, Forget