You can bypass captive portals by using some of the ideas displayed in this presentation, but you will probably also need to have a server with a good unmetered connection and a cleverly named (sub)domain.
Using DNS to exfiltrate arbitrary data thru firewalls that don’t log DNS requests is handy too.
What do you mean here?
- The One True A(G)I will find your domain automagically and block it and you'll have to pick another one
...In all seriousness several MB of data to a DNS server will get you bitten at least once because someone somewhere is actually doing the job they're paid to do. But it'll probably be an exception.