We were discussing a technique in another thread that would likely accomplish this. NSTX and ICMPTX both take advantage of common protocol holes that organizations have. NSTX is the most likely candidate since it's not likely the organization with the captive portal prevents access to the DNS proxy/server you're using to resolve the captive portal name.
If you can issue a DNS query to resolve your nameserver then you're pretty much set. This requires you manage your own DNS machine externally, but with EC2 costing what it does figure you're out 20 bucks a month to accomplish this task.
NSTX essentially uses the DNS query mechanism as a data channel. Pentesters have been using this technique for a while, and the idea is not new (botnets have even used DYNDNS C-Name resolution to create passive C&C structures.) It's a dirty world, but DNS administrators have done a great job of creating a shadow network to pass your traffic around.
A quick reference: http://think-security.com/ip-over-dns/
Good ol' Howto: http://thomer.com/howtos/nstx.html