Cell phones ping on their own when they try to log in to stations. There are devices that offer a virtual stations (law enforcement uses them around here). With an array of antennas it is possible to determine the direction of the signal. When using phase shift detection the direction should be fairly accurate.
The distance is not that easy to determine. The phone has some unknown latency when processing and returning the signal. That latency is enough to invalidate the measurement as the signal travels at light speed.