Run a dynamic web server (node, django, php, jsp, asp, whatever) and allow file uploads. Imagine the fun!
Make sure the server stays up to date and prevent the most obvious exploits like system calls, uploading outside the site folder and .htaccess files that redirect everything to CP. Basically run metasploit against your own server and check if it's all good.