As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is required), does it mean that all subsequent traffic will be sent unencrypted even after the user has authenticated via the captive portal?(Which means that an attacker can sniff all traffic and inject arbitrary packets)
Yes, wireless networks protected only by a captive portal are unsecured. They work by denying access to websites other than the captive portal until the connected device, identified by MAC address, has clicked through the portal. Requests to non-HTTPS sites made through the network are sent in the clear, the same as an entirely open network.