You could just upload the file and then post the link in a thread or page node.
If you protect the directory with .htaccess authorisation and set user group permissions on the thread/page, that would more or less achieve the same thing as attaching a file.