I found a script for bypassing captive portals on Linux back in the day...

The full functionality of how it works escapes me at the moment, but essentially it searches the network for a host that possibly already connected through the captive portal and spoofs their MAC address.

This isn't the one I originally found, but its the same principal and a Kali tool, so it may be considered more secure than the original bash script I copied back in the day:

https://en.kali.tools/?p=724